Administration device, administration control method, and program

ABSTRACT

An administration device in a system in which a first device group and a second device group are connected to a network. The administration device acquires first communication history of the first device group and second communication history of the second device group, compares first specific information which specifies communication source and communication destination of the first communication history and second specific information which specifies communication source and communication destination of the second communication history while referring to relating information and detects a setting error of the second specific information set in the devices of the second device group based on a result of the comparison.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is based upon and claims the benefit of priority of theprior Japanese Patent Application No. 2012-269025, filed on Dec. 10,2012 and the prior Japanese Patent Application No. 2013-208590, filed onOct. 3, 2013, the entire contents of which are incorporated herein byreference.

FIELD

The embodiments discussed herein are related to an administrationdevice, an administration control method, and a program.

BACKGROUND

In large-scale systems such as a cloud system, an administrator installsmore hardware components for the cloud system in order to deal with anincrease in resource requests due to an increase in the number of usersfor the cloud system. In the aforementioned installment, theadministrator installs more hardware components in unit of partialsystem in which a plurality of hardware components are unified as oneunit.

When the administrator installs one or more partial systems, a firstconstitution, that is included in the partial system to be added, isequally or approximately equally set to a second constitution includedin the existing (already installed) partial system. The aforementionedfirst constitution and second constitution are constructed by hardwarecomponents and software components respectively, for example. There is acase where the administrator partially customizes various settinginformation that is set in the hardware components and softwarecomponents in the existing partial system, for designing for the partialsystem to add. Then, the administrator sets customized various settinginformation to the hardware components and software components in thepartial system to add.

Functions of the existing partial system and the functions of thepartial system to be added are equal or approximately equal, theadministrator equalizes or approximately equalizes the firstconstitution with the second constitution and further carries out theaforementioned partial customization.

When the administrator partially customizes the various settinginformation and sets the various setting information to the hardwarecomponents and the software components in the partial system to beadded, there is a case where an error in settings (hereinafter,appropriately referred to as “setting error”) occurs. This setting erroris often involved with the settings of information (hereinafter,appropriately referred to as communication relating information) relatedto network communication (hereinafter, appropriately referred to ascommunication) such as IP addresses and port numbers.

Regarding a distributed system which is constituted in such a mannerthat a plurality of apparatuses are connected to a network, there hasbeen proposed a technique by which the apparatuses are automaticallyset, thereby making it possible to establish mutual communications (seePatent Document 1: Japanese Unexamined Patent Application PublicationNo. 2000-269998).

In order to avoid the setting error above, it is conceivable that theaforementioned technique is utilized. However, it is difficult to setthe IP addresses and the port numbers, which are partially customizedfor the partial system to be added, in the hardware components in thepartial system to be added, based on the aforementioned technique.

Accordingly, the administrator manually customizes the communicationrelating information such as the IP addresses and the port numbers andsets the customized communication relating information in the hardwarecomponents. After the partial system is added, the administratorverifies whether the partial system appropriately operates prior to theoperation of the partial system.

In the aforementioned verification, the administrator needs toexpeditiously recognize the content of the setting error and correct thesetting error. However, it is troublesome and difficult for theadministrator to detect the setting error by manual. In particular, in acase where the setting errors often occur due to an increase in thescale of the systems to be added, it is significantly troublesome anddifficult for the administrator to manually detect the setting error.

SUMMARY

According to an aspect of the embodiments, an administration device in asystem in which a first device group and a second device group areconnected with each other, includes a storage device configured to storerelating information that maps devices of the first device group withdevices of the second device group and a control unit configured toacquire first communication history of the first device group and secondcommunication history of the second device group, compare first specificinformation, which specify a transmission source and a transmissiondestination in the first communication history, with second specificinformation, which specify a transmission source and a transmissiondestination in the second communication history by referring to therelating information, and detect a setting error of the second specificinformation set in the devices of the second device group based on aresult of comparison.

The object and advantages of the invention will be realized and attainedby means of the elements and combinations particularly pointed out inthe claims.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory and arenot restrictive of the invention.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a hardware block diagram of an entire system as one example;

FIG. 2 is a hardware block diagram to explain an operator administrationserver group, a first block, and a second block in FIG. 1 as oneexample;

FIG. 3 is a hardware block diagram to explain a region administrationserver group in FIG. 1 as one example;

FIG. 4 is a hardware block diagram to explain various hardwarecomponents described in FIG. 2 as one example;

FIG. 5 is a hardware block diagram to explain an administration devicein FIG. 1 as one example;

FIG. 6 is a diagram of construction of a first table to explain acommunication log database in FIG. 5;

FIG. 7 is a diagram of construction of a second table to explain thecommunication log database in FIG. 5;

FIG. 8 is a diagram of construction of a table to explain a servercorrespondence database in FIG. 5;

FIG. 9 is a block diagram of a software module of the administrationdevice in FIG. 5;

FIG. 10 is a flowchart to explain the flow of acquisition processing andmerging processing of communication logs;

FIG. 11 is a diagram to explain the acquisition processing and themerging processing of the communication logs;

FIG. 12 is a diagram of construction of a table to describe theconversion processing of the communication logs;

FIG. 13 is a diagram to explain a communication log table in which acorrespondence presence column is added to the communication log tablein FIG. 7;

FIG. 14 is a first flowchart to explain the entire flow of thecomparison processing of the communication logs and the detectionprocessing for the setting errors;

FIG. 15 is a flowchart to explain the comparison of the communicationlogs and the detection of the setting errors at Step S13 in FIG. 14;

FIG. 16 is a diagram to explain correspondence and non-correspondencebetween the communication logs in a state where the port number of atransmission source and the port number of a transmission destinationare both merged;

FIG. 17 is a diagram to explain correspondence and non-correspondencebetween the communication logs in a state where the port number of thetransmission source and the port number of the transmission destinationboth are not merged;

FIG. 18A and FIG. 18B are diagrams to explain the extraction of asetting error candidate, which is executed at Step S14 in FIG. 14;

FIG. 19 A and FIG. 19B are first diagrams to explain the detectionprocessing for the setting errors, which is executed at the Step S14 inFIG. 14;

FIG. 20 is a second diagram to explain the detection processing for thesetting errors, which is executed at the Step S14 in FIG. 14;

FIG. 21 is a third diagram to explain the detection processing for thesetting errors, which is executed at the Step S14 in FIG. 14;

FIG. 22 is a hardware block diagram of an information processing systemSYS that includes a plurality of first device groups in which theoperational verification has already been completed, as one example;

FIG. 23 is a diagram illustrating construction of a table to describe aserver correspondence database DB2 in the embodiment of the presentinvention;

FIG. 24 is a diagram illustrating a table illustrating a state where thecommunication logs of the first block A20 a are merged, and the IPaddresses are appropriately converted, as one example;

FIG. 25 is a diagram illustrating a table illustrating a state where thecommunication logs of the second block B20 b are merged, and the IPaddresses are appropriately converted, as one example;

FIG. 26 is a diagram illustrating a table illustrating a state where thecommunication logs of the third block C20 c are merged, and the IPaddresses are appropriately converted, as one example;

FIG. 27 is a diagram illustrating a table illustrating a state where amaster communication log is stored, as one example;

FIG. 28 is a diagram illustrating a table illustrating a state where thecommunication logs of a fourth block are merged;

FIG. 29 is a second flowchart to explain the entire flow of thecomparison processing of the communication logs and the detectionprocessing for setting errors;

FIG. 30 is a diagram illustrating a table illustrating a state where thecommunication logs of the first block A20 a are merged, and the IPaddresses are appropriately converted, as another example;

FIG. 31 is a diagram illustrating a table illustrating a state where thecommunication logs of the second block B20 b are merged, and the IPaddresses are appropriately converted, as another example;

FIG. 32 is a diagram illustrating a table illustrating a state where thecommunication logs of the third block C20 c are merged, and the IPaddresses are appropriately converted, as another example;

FIG. 33 is a diagram illustrating a table illustrating a state where amaster communication log is stored, as one example;

FIG. 34 is a hardware block diagram to explain an administration deviceas another example;

FIG. 35 is a block diagram of a software module of the administrationdevice in FIG. 34;

FIG. 36 is a diagram illustrating a table illustrating a communicationlog of a setting error candidate including IP address of a targetserver;

FIG. 37 is a diagram illustrating a diagram to explain definitions touse when explaining a clustering, as one example;

FIG. 38 is a first flow diagram to explain a shaping process in whichthe clustering unit executes;

FIG. 39A is a second flow diagram to explain a shaping process in whichthe clustering unit executes;

FIG. 39B is a third flow diagram to explain a shaping process in whichthe clustering unit executes;

FIG. 40 is a diagram illustrating a table to store the communication logof the setting error candidate which is shaped, as one example;

FIG. 41 is a flow diagram to explain a clustering process, as oneexample;

FIG. 42 is a diagram to explain a first embodiment of the clustering, asone example;

FIG. 43 is a diagram illustrating a state table in which the IPaddresses included in the shaping log table in FIG. 40 are clustered;

FIG. 44 is a diagram illustrating a table to store the clustering logincluding a number of communications, as one example;

FIG. 45 is a diagram illustrating a table to store the communication logof the setting error candidate which is shaped, as another example;

FIG. 46 is a diagram to illustrate a relationship the port number, thenumber of communication and the IP address by a tree construction;

FIG. 47 is a diagram illustrating a state table in which the IPaddresses included in the shaping log table in FIG. 45 are clustered;

FIG. 48 is a diagram illustrating a state table in which the IPaddresses included in the shaping log table in FIG. 44 are clusteredwithout referring to the number of communication as a basis of asimilarity;

FIG. 49A, FIG. 49B, FIG. 49C and FIG. 49D are first diagrams toillustrate a construction element, relating element information and arelationship between the construction element and the relating elementinformation;

FIG. 50A, FIG. 50B and FIG. 50C are second diagrams to illustrate aconstruction element, a relating element information and a relationshipbetween the construction element and the relating element information;

FIG. 51 is a diagram illustrating a network construction of devices andservers in which the IP address of transmission source and the IPaddress of a transmission destination are set in the fourth embodimentdescribed in FIG. 35;

FIG. 52 is a flow diagram to explain grouping of the IP address, as oneexample;

FIG. 53 is a diagram to illustrate a relationship from a target serverto a partner server;

FIG. 54 is a diagram to illustrate a grouping process of IP addresseswhich are set to each servers that the relationship from a target serverto a partner serve are matched;

FIG. 55 is a flow diagram to explain re-clustering;

FIG. 56 is a first diagram to explain a first embodiment of there-clustering;

FIG. 57 is a second diagram to explain a second embodiment of there-clustering;

FIG. 58 is a diagram to explain a state that the clustering logsincluding six IP addresses belonging to same parent node N5 areaggregated in clustering logs which are illustrated in a narrow resulttable Tn1 in FIG. 43; and

FIG. 59 is a diagram to explain a case that the aggregation of theclustering logs is not executed in one group.

DESCRIPTION OF EMBODIMENTS

(Information Processing System)

FIG. 1 is a hardware block diagram to describe an information processingsystem SYS of the embodiment as one example. In the description below,the same reference numbers are applied to elements having the samefunctions, and the detailed description of the elements is appropriatelyomitted. In the embodiment, the information processing system SYS is acloud system. The information processing system SYS includes a router RCconnected to a network N, a firewall FW, an operator administrationserver group MC, a region administration server group RM, a first blockA20 a, a second block B20 b, and an administration device 4. The networkN is exemplified by LAN (Local Area Network). It is noted that the blockis also referred to as a data center.

The information processing system SYS connects a user terminal USR,which a user of the cloud system operates, via the Internet IN. Theinformation processing system SYS executes data processing in responseto a data processing request from the user terminal USR and transmitsthe processing results to the user terminal USR. For the illustrativeconvenience, FIG. 1 illustrates only one user terminal USR, but amagnitude of user terminals are connected to the information processingsystem SYS via the Internet IN. In the diagram, the upper side of FIG. 1represents a user side with a dotted chain line as a reference, and thelower side of FIG. 1 represents an information processing system SYSside with the dotted chain line as the reference.

The router RC is a communication device that mutually connects theInternet IN with the network N in the information processing system SYS.The firewall FW is a device that includes a so-called firewall functionof preventing an unauthorized access to the network N in the informationprocessing system SYS. The operator administration server group MC is aserver group for operating the information processing system SYS andincludes a plurality of servers to execute the operating processing.

The first block A20 a is the existing (already installed) partial systemand includes a block administration server group 21 and a user servergroup 22. The user server group 22 includes a plurality of servers whichexecute various data processing in response to the request from the userterminal USR. The block administration server group 21 includes aplurality of servers to administrate the user server group 22. Regardingto the block administration server group 21 and the user server group 22in the first block A20 a, the operational verification has already beencompleted. The first block A20 a is also referred to as operationalverification-completed first block A20 a or configuration-completedfirst block A20 a. The words “operational verification-completed” meansthat the operational verification, in which the execution of anappropriate operation based on the design specifications is verified,has already been completed with respect to the server group (forexample, the first block A20 a).

The second block B20 b is the partial system to be added, and the secondblock B20 b includes a block administration server group 23 and a userserver group 24. The user server group 24 includes a plurality ofservers which execute various data processing in response to the requestfrom the user terminal USR. The block administration server group 23includes a plurality of servers to administrate the user server group24. Regarding the block administration server group 23 and the userserver group 24 in the second block B20 b, the operational verificationhas not been completed. The second block B20 b is also referred to as anoperational-verification-target second block B20 b or a second block B20b for which the operational verification has not been completed, or asecond block B20 b that is currently being configured.

The region administration server group RM is a device that administratesthe first block A20 a and the second block B20 b and includes aplurality of servers to execute the administration processing.

The administration device 4 is a device that administrates the entireoperational verification in a case where the operational verificationfor the partial system as a subject of the operational verification iscarried out.

FIG. 2 is a hardware block diagram to describe the operatoradministration server group MC, the first block A20 a, and the secondblock B20 b in FIG. 1, as one example. The operator administrationserver group MC includes a firewall 11, which is connected to thenetwork N1, a WEB server 12, a mail server 13, a CMDB (ConfigurationManagement Database) 14, an individual authentication server 15, a NTP(Network Time Protocol) server 16, and a DNS (Domain Name System) server17.

The firewall 11 is a device that includes a so-called firewall functionof preventing an unauthorized access to the network N1 in the operatoradministration server group MC. The WEB server 12 provides HTML (HyperText Markup Language) data written in HTML in response to a request fromthe web browser of a client. The mail server 13 executes thetransmission and reception of electronic mail, and for example,functions as a SMTP (Simple Mail Transfer Protocol) server or a POP(Post Office Protocol) server.

The CMDB 14 is a database that collects the constitutional informationof constitutional elements constituting the information processingsystem SYS and administrates the constitutional information to becollected in an integrated way. The constitutional elements, forexample, include the hardware components and software components. Thehardware components, for example, include servers, which are informationprocessing devices, network devices such as routers and switches, andstorage devices such as HDD (Hard Disk Drive). The individualauthentication server 15 authenticates users of the cloud system. TheNTP server 16 synchronizes with a correct time that each server has. TheDNS 17 is a server that administrates the correlation between the domainname of the server in the information processing system SYS and the IPaddress which is set to the server.

The user server group 22 of the first block A20 a includes a firewall221, which is connected to a network N, and a VM server 222. VM is anabbreviation of virtual machine (VM: Virtual Machine). For theillustrative convenience, in the user server group 22, one firewall 221and one VM server 222 are respectively illustrated in the diagram.However, the user server group 22 may include a plurality of firewalls221 and a plurality of VM servers 222. Moreover, the user server group22 may include the network device and the storage device.

The firewall 221 is a device that includes the so-called firewallfunction of preventing an unauthorized access to the network N3 in theuser server group 22. The VM server 222 virtualizes hardware resourcesin its own device, and for example, executes VM (virtual machines) thatperform various data process in response to the request from the user.Besides, the VM server 222 may execute virtual routers (VR).

The block administration server group 21 includes a firewall 211, animage administration server 212, which is connected to the network N2, anetwork administration server 213, and a storage administration server214. The firewall 211 is a device that includes the so-called firewallfunction of preventing an unauthorized access to the network N2 in theblock administration server group 21.

The image administration server 212 administrates the VM image of thevirtual machine executed by the VM server 222 of the user server group22. The image administration server 212, for example, administrates theresource amount of hardware resources that are allotted to each virtualmachine executed by the VM server 222 of the user server group 22. Thenetwork administration server 213 administrates communication devices inthe user server group 22 and various setting information (IP addressesand the like) of the communication devices. For example, the networkadministration server 213 administrates the IP addresses set in thefirewall 211 and the VM server 222 of the user server group 22 and theIP addresses set in the virtual machines executed by the VM server 222.

The storage administration server 214 administrates a storage system(not illustrated) of the user server group 22. For example, the storageadministration server 214 administrates the constitutional informationon the storage system (not illustrated) allotted to the virtual machinesexecuted by the VM server 222 and the performance information such asstorage capacity. Furthermore, it is noted that the block administrationserver group 21 may include various servers such as a WEB server, a mailserver, a CMDB, and a DNS server.

The user server group 24 of the second block B20 b includes a firewall241, which is connected to a network N5, and a VM server 242. In theuser server group 24, for the illustrative convenience, only onefirewall 241 and one VM server 242 are illustrated. However, the userserver group 24 may include a plurality of firewalls 241 and a pluralityof VM servers 242. Besides, the user server group 24 may include networkdevices such as routers and switches and storage devices.

The firewall 241 is a device that includes the so-called firewallfunction of preventing an unauthorized access to the network N5 in theuser server group 24. The VM server 242 virtualizes hardware resourcesin its own device, and for example, executes the virtual machines thatperform various data process in response to the request from the user.Besides, the VM server 242 may execute virtual routers (VR: VirtualRouter).

The block administration server group 23 includes a firewall 231, whichis connected to the network N4, an image administration server 232, anetwork administration server 233, and a storage administration server234. The firewall 231 is a device that includes the so-called firewallfunction of preventing an unauthorized access to the network N4 in theblock administration server group 23.

The image administration server 232 administrates the VM images of thevirtual machine executed by the VM server 242 of the user server group24. The image administration server 232, for example, administrates theresource amount of hardware resources that are allotted to each virtualmachine executed by the VM server 242 of the user server group 24. Thenetwork administration server 233 administrates communication devices inthe user server group 24 and various setting information (IP addressesand the like) of the communication devices. For example, the networkadministration server 233 administrates the IP addresses set in thefirewall 241 and the VM server 242 of the user server group 24 and theIP addresses set in the virtual machines executed by the VM server 242.

The storage administration server 234 administrates a storage system(not illustrated) of the user server group 24. For example, the storageadministration server 234 administrates the constitutional informationon the storage system (not illustrated) allotted to the virtual machinesexecuted by the VM server 242 and the performance information such asstorage capacity. Furthermore, it is noted that the block administrationserver group 23 may include various servers such as the WEB server, themail server, the CMDB, and the DNS server.

The processing executed by the information processing system SYS in acase where the user utilizes a cloud service will be described based onFIGS. 1 and 2. The cloud service means an information processing serviceexecuted by the information processing system SYS. The user operates theuser terminal USR in FIG. 1 and accesses to the information processingsystem SYS. Specifically, for example, the user operates the userterminal USR and transmits a user ID (identifier) and a password to theindividual authentication server 15 in FIG. 2, thereby making anauthentication request.

The individual authentication server 15 authenticates the user based onthe user ID and the password to be transmitted. For example, when theindividual authentication server 15 successfully completes theauthentication, the image administration server 212 of the blockadministration server group 21 in FIG. 2 instructs the VM server 222 ofthe user server group 22 to activate and execute the virtual machine forthe user. In response to the instruction, the VM server 222 activatesthe virtual machine for the user and puts the virtual machine into anoperable state. Hereafter, the user accesses to the virtual machine viathe user terminal USR, thereby performing various data processing.

The information processing system SYS described in FIGS. 1 and 2 isfurther described. FIG. 3 is a hardware block diagram to describe theregion administration server group RM in FIG. 1 as one example. Theregion administration server group RM includes a firewall 31, an imageadministration server 32, a network administration server 33, and a WEBserver 34, each of which is connected to a network N6 in the regionadministration server group RM.

The firewall 31 is a device that includes the so-called firewallfunction of preventing an unauthorized access to the network N6 in theregion administration server group RM. The image administration server32 is a server that administrates the constitutional information of thevirtual machine executed by the image administration server 212 of theblock administration server group 21 and the constitutional informationof the virtual machine executed by the image administration server 232of the block administration server group 23. Besides, the imageadministration server 32 administrates the IP addresses of the imageadministration server 212 and the IP addresses of the imageadministration server 232.

The network administration server 33 is a server that administrates theIP addresses of the network administration server 213 of the blockadministration server group 21 and the IP addresses of the networkadministration server 233 of the block administration server group 23.The WEB server 34 provides HTML data written in HTML in response to arequest from the web browser of a client.

FIG. 4 is a hardware block diagram as one example to describe varioushardware components described in FIGS. 1 to 3. In FIG. 4, a server isillustrated as one example of various hardware components. Besides, thesimilar constitution of the server may be applied to the firewalls andswitches.

A server SVR is exemplified as a device for data processing and onedevice included in the device group. For example, the server SVRincludes a CPU (Central Processing Unit) 201, a memory 202, a storagedevice 203, a communication device 204, an operation control unit 205, adisplay control unit 206, and a storage medium reading device 207, eachof which is connected to each other via a bus B.

The CPU 201 is a computer (control unit) to control the entire serverSVR. The memory 202 temporarily stores data processed in variousinformation processing executed by the CPU 201 and various programs. Thestorage device 203, for example, is constructed by a magnetic storagedevice such as the HDD (Hard Disk Drive) and a non-volatile memory. Thestorage device 203 stores a variety of communication history describedlater. Hereinafter, the communication history is appropriately referredto as “communication log”, and a plurality of communication logs isappropriately referred to as “communication log group”. Then, thecommunication log group is illustrated by a reference number “LG” inFIG. 4.

The communication device 204, for example, is exemplified by NIC(Network Interface Card), thereby connecting to the network N, andperforms network communications with various devices connected to thenetwork N. Although the connection depends on the location where theserver SVR is installed, there is a case where the communication device204 connects to any of the networks N1 to N6.

Upon the reception of the operational instruction inputted from anoperation device 205 a, the operation control unit 205 executes variousprocessing in response to the operational instruction. The operationdevice 205 a, for example, is a keyboard or a mouse.

The display control unit 206 executes processing of displaying variousimages on a display device 206 a. Herein, various images, for example,include setting images for the IP addresses and the port numbers. Thedisplay device 206 a, for example, is a liquid crystal display.

The storage medium reading device 207 is a device to read data recordedin a storage medium 207 a. The storage medium 207 a is exemplified by aportable storage media such as CD-ROM (Compact Disc Read Only Memory),DVD (Digital Versatile Disc), and USB (Universal Serial Bus). It isnoted that the later-described programs (referred to as software) may bestored in the storage medium 207 a.

The specific processing software 2021 in the memory 202 is a softwarecomponent to execute specific processing (function). When the server SVRis the DNS server, the specific processing software 2021 executes aso-called DNS function, wherein the correlation between the domain nameand the IP address is administrated. When the server SVR is the mailserver, the specific processing software 2021 executes a SMTP functionand a POP function. Also, when the server SVR is the imageadministration server, the specific processing software 2021 executes animage administration function.

The communication software 2022, for example, is a software component toexecute TCP/IP communications. The specific processing software 2021executes network communications with software executed by other serversor the virtual machines with the use of communication software 2022.When the network communications are executed, the communication software2022 records various information with regards to the communications tobe executed and stores the various information in the storage device 203as a communication log. The communication log is used when theadministration device 4 automatically detects the setting error of thecommunication relating information.

For example, a case is assumed where the specific processing software2021 utilizes the communication software 2022 and communicates withsoftware that operates on other server (not illustrated). It is assumedthat the IP address of the server SVR is “x1. y1. z1. w1” and the portnumber used by the specific processing software 2021 is “p1”. Then, Itis assumed that the IP address set by other server is “x2. y2. z2. w2”and the port number used by the software operated on the other server is“p2”.

When systems are added, the administrator operates the operation device205 a in the server SVR to be added, and sets the aforementioned IPaddress (“x1. y1. z1. w1”) in advance to the server SVR. Further, theadministrator operates the operation device 205 a in the server SVR andsets the port number (“p2”) of a communication counterpart in advance tothe specific processing software 2021 as a port number of a transmissiondestination. The administrator operates the operation device 205 a inthe server SVR and sets the port number in advance in the specificprocessing software 2021 in such a manner that the port number “p1” isused by the specific processing software 2021 as a port number of atransmission source. Also, when the other server is added, theadministrator sets the aforementioned IP address (“x2. y2. z2. w2”) tothe other server in advance and sets the port number (“p2”) in advancein specific processing software (not illustrated) executed by the otherserver.

The communication software 2022 creates communication packets in whichthe IP address of a transmission source is “x1. y1. z1. w1”, and theport number of the transmission source is “p1”, and the IP address of atransmission destination is “x2. y2. z2. w2”, and the port number of thetransmission destination is “p2”. Then, the communication software 2022transmits the communication packets (also referred to as “datatransmission”) inclusive of transmission data (also referred to as“payload”) to the other server.

While the communication software 2022 transmits the communicationpackets, the communication software 2022 simultaneously generates thecommunication log in which the IP address of the transmission source is“x1. y1. z1. w1”, and the port number of the transmission source is“p1”, and the IP address of the transmission destination is “x2. y2. z2.w2”, and the port number of the transmission destination is “p2”, andstores the communication log in the storage device 203. Thus, thecommunication software 2022 records the specific information thatspecifies the transmission source and the transmission destination interms of communications, as the communication log. The communication logis made up of at least data includes the specific information thatspecifies the transmission source and the transmission destination interms of communications.

The communication software 2022 establishes the connection with theother server prior to the data transmission. When the connection issuccessfully established, the communication software 2022 adds “OK” as astate to the communication log. In contrast, when the connection withthe other server is not established, the communication software 2022stores “no response” as a state. Then, in response to the storage of “noresponse”, the communication software 2022 stores the communication login which the IP address of the transmission source is “x1. y1. z1. w1”,and the port number of the transmission source is “p1”, and the IPaddress of the transmission destination is “x2. y2. z2. w2”, and theport number of the transmission destination is “p2”. Also, thecommunication software 2022 stores the number of communications.

Subsequently, the administrator sets the IP address of the transmissionsource in the server of the second block B20 b that is currently beingconfigured. And the administrator further sets in advance the portnumber of the transmission destination, the port number of thetransmission source, and the IP address of the transmission destinationto the specific processing software operated on this server. However,the setting error often occurs at the time of settings. Accordingly, theadministrator needs to perform the operational verification for thesecond block B20 b and correct the setting error based on theverification results. Hereinafter, the administration device 4 thatautomatically detects the setting error will be described.

[First Embodiment of Administration Device]

(Hardware Block Diagram of Administration Device)

FIG. 5 is a hardware block diagram to describe the administration device4 in FIG. 1 as one example. The administration device 4, for example,includes a CPU 401, a memory 402, a storage device 403, a communicationdevice 404, an operation control unit 405, a display control unit 406,and a storage medium reading device 407, each of which is connected toeach other via the bus B.

The CPU 401 is a computer (control unit) to control the entireadministration device 4. The memory 402 temporarily stores dataprocessed in various information processing executed by the CPU 401 andvarious programs. The storage device 403 is made up of a magneticstorage device such as the Hard Disk Drive and a non-volatile memory.The storage device 403 stores a communication log database DB1 and aserver correspondence database DB2 described later.

The communication device 404 is exemplified by Network Interface Cardand connected to the network N and communicates with various devicesconnected to the network N.

Upon the reception of the operational instruction inputted from anoperation device 405 a, the operation control unit 405 executes variousprocessing in response to the operational instruction. The operationdevice 405 a, for example, is a keyboard or a mouse.

The display control unit 406 executes processing of displaying variousimages on a display device 406 a. Herein, various images, for example,include images including various information which is related to thesetting error. The display device 406 a, for example, is a liquidcrystal display.

The storage medium reading device 407 is a device to read data recordedin a storage medium 407 a. The storage medium 407 a is exemplified by aportable storage media such as CD-ROM, DVD, and USB. It is noted thatprograms described in FIG. 9 may be stored in the storage medium 407 a.

(Communication Log Database)

FIG. 6 is a first table to describe the communication log database DB1in FIG. 5. A communication log table T1 a is a table that stores thecommunication log of which the administration device 4 obtains from thefirst block A20 a, as one example. A reference number “To” in FIG. 5illustrates a state where the communication log database DB1 in FIG. 5stores the communication log table T1 a.

The communication log table T1 a includes a transmission-source IPaddress column, a transmission-source port number column, atransmission-destination IP address column, and atransmission-destination port number column. In the communication logtable T1 a, each line stores one communication log. The content of eachcolumn will be described later.

FIG. 7 is a second table to describe the communication log database DB1in FIG. 5. A communication log table T1 b is a table that stores thecommunication log of which the administration device 4 obtains from thesecond block B20 b, as one example. A reference number “Ts” in FIG. 5illustrates a state where the communication log database DB1 in FIG. 5stores the communication log table T1 b.

The communication log table T1 b includes the transmission-source IPaddress column, the transmission-source port number column, thetransmission-destination IP address column, the transmission-destinationport number column, and a state column. In the communication log tableT1 b, each line stores one communication log. The content of each columnwill be described later.

(Server Correspondence Database)

FIG. 8 is a table to describe the server correspondence database DB2 inFIG. 5. A reference number “TR” in FIG. 5 illustrates a state where theserver correspondence database DB2 in FIG. 5 stores a servercorrespondence table TR1. The server correspondence table TR1 includesan IP address column (first block A) and an IP address column (secondblock B). The IP address column (first block A) stores an IP address setin the server that the first block A20 a includes. The IP address column(second block B) stores an IP address set in the server that the secondblock B20 b includes.

The server correspondence table TR1 is one example of relatinginformation respectively related between the devices of the first devicegroup, in which the operational verification has already been completed,and the devices of the second device group which is targeted for theoperational verification. The storage device 403 in FIG. 5 stores therelating information. As is described in FIG. 19, an IP address “12. 0.3. 7.” is not stored in the IP address column (second block B) of theserver correspondence table TR1.

The first device group, for example, is the first block A20 a in FIG. 2.The devices of the first device group, for example, include the serversof the first block A20 a, such as the image administration server 212,and the VM server 222. The second device group, for example, is thesecond block B20 b in FIG. 2. The devices of the second device group,for example, include the servers of the second block B20 b, such as theimage administration server 232, and the VM server 242.

In FIG. 8, each server, whose the IP address stored in the same line inthe diagram is set, has the same function. Herein, a server, in whichthe IP address “192. 168. 1. 23” stored in the IP address column (thefirst block A) is set, is referred to as “server A”. The server A and aserver (hereinafter referred to as “server B”), in which the IP address“192. 168. 1. 23” stored in the IP address column (the second block B)is set at the same line as that of the aforementioned IP address (“192.168. 1. 23”) of the server A, are servers having similar functions. Forexample, when the server A is the DNS server, the server B is similarlythe DNS server.

That is, the server correspondence table TR1 includes the IP address,which is set in the devices of the first device group in whichoperational verification has already been completed, and the IP address,which is set in the devices of the second device group which is targetedfor the operational verification. And the devices of the second devicegroup have the same functions as those of the devices of the firstdevice group.

The administrator operates the operation device 405 a (see FIG. 5) andproduces the server correspondence table TR1 in advance, and stores theserver correspondence table TR1 in the server correspondence databaseDB2 in FIG. 5. It is assumed that the IP address stored in the servercorrespondence table TR1 is a correct IP address. Incidentally, themethod of producing the server correspondence table is not limited, buta manual or automatic (mechanical) method may be applied.

(Block Diagram of Software Module of Administration Device)

FIG. 9 is a block diagram of the software module of the administrationdevice 4 in FIG. 5. In the diagram, the storage device 403 and thecommunication device 404, which are the hardware components in theadministration device 4, are illustrated in a dotted line.

The administration device 4 is one example of a device that detects thesetting error in the specific information to specify the transmissionsource and the transmission destination in terms of communications inthe information processing system SYS (see FIG. 1) in which the firstdevice group and the second device group are connected to the network.Herein, the specific information includes the IP addresses of thetransmission source and the transmission destination and the portnumbers of the transmission source and the transmission destination.

In order to detect the aforementioned setting error in the specificinformation and notify the administrator of the setting error, theadministration device 4 includes a communication log acquiring unit 41,a communication log shaping unit 42, a communication log comparing unit43, an error detecting unit 44, and a notifying unit 45.

The communication log acquiring unit 41 acquires the first communicationlog of the network communication of the first device group (e.g., thefirst block A20 a), in which operational verification has already beencompleted. Further, the communication log acquiring unit 41 acquires thesecond communication log of the network communication of the seconddevice group (for example, the second block B20 b), which is targetedfor the operational verification. As is described in FIG. 4, the secondcommunication log includes communication state information whichrepresents that the network communication has normally been executed(communication state “OK”) or that the network communication has notnormally been executed (“no response”).

The communication log shaping unit 42 shapes the first and secondcommunication logs acquired by the communication log acquiring unit 41and stores the communication logs, in order to reduce the amount ofstorage regarding the communication logs. The communication logcomparing unit 43 refers to the server correspondence table TR1 andcompares the first specific information of the first communication logwith the second specific information of the second communication logcorresponding to the first communication log.

The error detecting unit 44 detects the setting error (also referred toas a setting mistake) of the specific information set in the devices(for example, servers) of the second device group based on thecomparison results of the aforementioned first specific information andthe aforementioned second specific information. The notifying unit 45notifies the administrator of the setting error detected by the errordetecting unit 44 via the display control unit 406 and the displaydevice 406 a (see FIG. 5).

The communication log acquiring unit 41, the communication log shapingunit 42, the communication log comparing unit 43, the error detectingunit 44, and the notifying unit 45 are so-called programs. Theseprograms, for example, are stored in the storage device 403. Upon theactivation, the CPU 401 in FIG. 5 reads out these programs from thestorage device 403 and expands the programs in the memory 402, therebyfunctioning these programs as a software module.

(Addition of Hardware Components and Operational Verification)

The addition of hardware components will specifically be described basedon FIGS. 1, 2 and 4. When the resource request increases due to anincrease in the number of users of the information processing systemSYS, the administrator, for example, adds the hardware components inunit of the aforementioned partial system.

The aforementioned partial system may be made up of the blockadministration server group 21 or the block administration server group23. In this case, the partial system to be added is the blockadministration server group 23, and the existing partial system is theblock administration server group 21.

Regarding the addition of the hardware components in unit of theaforementioned partial system, the administrator equalizes orapproximately equalizes the first constitution of the partial system tobe added with the second constitution of the existing partial system.The aforementioned first and second constitutions are made up of thehardware components and the software components. The hardwarecomponents, for example, include servers, network devices, and storagedevices.

When the first and second constitutions are made up of hardwarecomponents, the equivalence of the first and second constitutions isrepresented as follows. That is, the equivalence means that, when thehardware components included in the existing partial system are made upof the first to An-th (An is an integer of two or more) servers, thehardware components included in the partial system to be added are alsomade up of the first to An-th servers. Also, when the first and secondconstitutions are made up of hardware components, the approximateequivalence of the first and second constitutions is represented asfollows. That is, the approximate equivalence means that, when thehardware components included in the existing partial system are made upof the first to An-th servers, the partial system to be added includesthe servers having functions that are equal to the functions of 80percent of the first to An-th servers.

When the first and second constitutions are made up of softwarecomponents, the equivalence of the first and second constitutions isrepresented as follows. That is, the equivalence means that, when thefirst to Bn-th (Bn is an integer of two or more) software componentsoperate in each server in the existing partial system, the first toBn-th software components operate in each server in the partial systemto be added. Also, when the first and second constitutions are made upof software components, the approximate equivalence of the first andsecond constitutions is represented as follows. That is, the approximateequivalence means that, when the first to Bn-th software componentsoperate in each server in the existing partial system, the partialsystem to be added executes software components that are equal to 80percent of the first to Bn-th software components in each server on itsown system. It is noted that the aforementioned 80 percent is a mere,exemplified numerical value.

The reasons that the administrator equalizes or approximately equalizesthe first constitution with the second constitution are as follows. Forexample, the first reason is that the administrator partially customizesvarious setting information which are set in the hardware components andthe software components of the existing partial system, for the purposeof designing the partial system to be added. And the administrator setsthe partially-customized setting information to the hardware componentsand the software components of the partial system to be added. In otherwords, this is because the administrator utilizes (also referred to as“reuse”) the various setting information set in the hardware componentsand the software components of the existing partial system, for thepurpose of designing the partial system to be added. The utilizationallows the administrator to reduce the number of processing steps in theoperation of adding servers.

Also, the second reason is that the administrator equalizes orapproximately equalizes the first constitution with the secondconstitution, thereby utilizing the experience cultivated through theadministration of the existing partial system, for the purpose ofadministrating the partial system to be added. This utilization allowsthe administrator to reduce the workload of administrating the partialsystem to be added

When the administrator adds the hardware components and sets varioussettings for the hardware components to be added or the softwarecomponents executed by the hardware components, there is a case wherethe settings regarding the communication association information areerroneously set.

For example, as is described above, when the administrator adds thepartial system, the administrator utilizes various setting informationset in the hardware components and the software components of theexisting partial system, with regards to the partial system to be added.This various setting information means the communication relatinginformation such as the aforementioned IP addresses and port numbers.

Regarding the utilization of the communication relating information, theadministrator partially customizes the IP addresses and the port numbersin the communication relating information that has been used for theexisting partial system. Then, the administrator sets the IP addressesand the port numbers to be customized, to the hardware components andthe software components of the partial system to be added.

For example, there is a case where the administrator sets a different IPaddress or a different port number to a server having the same functionin a different administration server group, in order to correspond to anindividual specification defined for each block administration servergroup. Accordingly, the administrator customizes the IP address or theport number.

In the example in FIG. 2, the administrator customizes the IP address orthe port number set in the image administration server 212 of the firstblock A20 a. And the administrator sets the customized IP address orport number to the image administration server 232, which has the samefunction as that of image administration server 212, of the second blockB20 b. For example, it is assumed that the administrator sets the IPaddress “12. 0. 3. 7” in the image administration server 212 of thefirst block A20 a. In this case, the administrator sets an IP address“12. 4. 3. 7”, which is a product of the customization of the IP address“12. 0. 3. 7”, in the image administration server 232, which has thesame function as that of image administration server 212, of the secondblock B20 b.

However, in the processing steps in the operation of adding the partialsystem, there is a case where the administrator fails to appropriatelycustomize the communication relating information such as the IPaddresses, or commits the setting error in the communication relatinginformation due to an inadvertent oversight with regard to thecustomization of the communication association information. As a result,appropriate data processing is not performed in the partial system to beadded (the second block B20 b in the example in FIG. 2). Accordingly,the administrator verifies whether the partial system to be addedappropriately operates prior to the operation of the partial system tobe added and corrects the setting error.

(Operational Verification)

The operational verification of the partial system to be added will bedescribed based on FIGS. 1, 2, and 4. For example, the administratorallows the second block B20 b to execute processing which is equivalentto the processing executed by the first block A20 a, as the operationalverification. The processing executed by the first block A20 a includesthe activation and execution of the virtual machine for the user and thestoppage of the virtual machine to be activated.

Specifically, the administrator instructs the image administrationserver 232 of the second block B20 b to activate and execute the virtualmachine for the operational verification. In response to theinstruction, the image administration server 232 transmits acommunication packet (hereinafter, merely referred to as “command”)including a command for instructing the transmission of the networkinformation that is used to activate and execute the virtual machine forthe operational verification, to the network administration server 233.In response to the command, the network administration server 233transmits the network information to the image administration server232. Simultaneously, the image administration server 232 transmits acommand for instructing the transmission of the storage information thatis used to activate and execute the virtual machine for the operationsverification, to the storage administration server 234. In response tothe command, the storage administration server 234 transmits the storageinformation to the image administration server 232.

The image administration server 232 transmits virtual machine activationinformation that is administrated by its own device, the networkinformation and the storage information to be received, along with thevirtual machine activation command, to the VM server 242 of the userserver group 24. In response to the virtual machine activation command,the VM server 242 activates and executes the virtual machinescorresponding to the virtual machine activation information, the networkinformation, and the storage information to be received. Theadministrator allows the virtual machines, which are activated andexecuted by the VM server 242, to execute various information process,and verifies whether operations are appropriately performed.

Upon the completion of the verification, the administrator instructs theimage administration server 232 of the second block B20 b to stop thevirtual machine for the operational verification. In response to theinstruction, the image administration server 232 transmits a commandthat is used to stop the virtual machine for the operationalverification, to the VM server 242. In response to the command, the VMserver 242 stops the virtual machines that have been executed. Upon thetransmission and reception of the commands between the aforementionedservers, each server produces the communication log and stores thecommunication log in its own device.

When correct communication relating information is set in the hardwarecomponents and the software components of the second block B20 b, thecommunications between the servers are appropriately performed in thecourse of the verification. In contrast, when correct communicationrelating information is not set in the hardware components and thesoftware components of the second block B20 b, the communicationsbetween the servers is not appropriately performed.

For example, a case is assumed where the software components (specificprocessing software) of the image administration server 232 communicateswith the network administration server 233. In this case, when thepartial system is added to the second block B20 b, the administratorneeds to correctly set the communication relating information for thenetwork administration server 233 of the transmission destination, inthe software components of the image administration server 232. Theaforementioned communication relating information, for example, includesthe IP address of the network administration server 233 of thetransmission destination, and the port number for services executed bythe network administration server 233. When correct communicationrelating information is not set in the image administration server 232,the image administration server 232 is unable to execute communicationswith the network administration server 233. As a result, the activationand execution of the aforementioned virtual machine are not carried out,which ends in failure in the operational verification of the secondblock B20 b. When the verification of operations fails, theadministrator analyzes the cause of the failure in the operationalverification.

The hardware components and the software components that are included inthe second block B20 b targeted for the operational verification areequal or approximately equal to the hardware components and the softwarecomponents that are included in the first block A20 a in which theoperational verification has already been executed and its operation isappropriately performed. Also, the administrator partially customizesthe communication relating information set in the server of the firstblock A20 a and sets the partially-customized communication relatinginformation in the server of the second block B20 b.

Herein, when the second block B20 b executes the processing that isequivalent to the processing executed by the first block A20 a, as theoperational verification, it is assumed that communication processing isappropriately operated in the second block B20 b targeted for theoperational verification. On this presumption, it can be assumed thatthere is a high probability that a communication log that corresponds orapproximately corresponds to the communication log existed in the firstblock A20 a, in which the operational verification has already beencompleted, exists in the second block B20 b targeted for the operationalverification.

In this time, according to study of the inventors, there is a highprobability that there occurs a setting error in the communicationrelating information related to the communication log that only existsin the first device group (for example, the first block A20 a) in whichthe operational verification has already been completed.

Furthermore, according to the study of the inventors, even when there isa communication log that corresponds to the communication log whichexist in the first device group, in which the operational verificationhas already been completed, among the communication logs which exist inthe second device group (for example, the second block B20 b) whichtargeted for the operational verification, there is a high probabilitythat there occurs the setting error in the communication relatinginformation which is related to this communication log. The reason forthis is that there is a case where the communication processingsuccessfully performed by an accident, which is described later.

Furthermore, there is a case where a communication log indicating thecommunication failure (communication state information is “no response”)is recorded in the communication logs existed in the second block B20 btargeted for the operational verification. Similarly regarding to thiscommunication log, there is a high probability that there occurs thesetting error in the communication relating information associated withthis communication log. Hereinafter, the communication log, in whichthere is a high probability that there occurs the setting error in thecommunication relating information, is appropriately referred to as acommunication log of a setting error candidate.

Therefore, the administration device 4 compares the communication log,existed in the first device group in which the operational verificationhas already been completed, with the communication log, existed in thesecond device group targeted for the operational verification, in thecourse of the operational verification. Subsequently, the administrationdevice 4 detects the communication log of the setting error candidatebased on the comparison results. The administration device 4 determinesthat there occurs the setting error in the communication relatinginformation related to the communication log of the setting errorcandidate to be detected and notifies the administrator to the effectthat there occurs the setting error. Hereinafter, the comparison of thecommunication logs and the detection and notification of the settingerror, each of which is executed by the administration device 4, will bedescribed in detail.

(Acquisition Processing and Merging processing of Communication Log)

The communication log acquiring unit 41 of the administration device 4in FIG. 9 acquires the communication log of the first device group inwhich the operational verification has already been completed, prior tothe operational verification, and the communication log shaping unit 42appropriately shapes (also referred to as “merge”) the communication logto be acquired. Then, in the operational verification, the communicationlog acquiring unit 41 acquires the communication log of the seconddevice group targeted for the operational verification, and thecommunication log shaping unit 42 appropriately merges the communicationlog to be acquired.

FIG. 10 is a flowchart to describe the flow of the acquisitionprocessing of communication logs and the merging processing of thecommunication logs by the administration device in FIG. 9. The flow ofprocessing executed by the communication log acquiring unit 41 and thecommunication log shaping unit 42 in FIG. 9 will be described referringto FIG. 10.

Step S1: the communication log acquiring unit 41 acquires thecommunication log of the first device group in which the operationalverification has already been completed, or acquires the communicationlog of the second device group targeted for the operationalverification. That is, the communication log acquiring unit 41 acquiresthe communication log of the first block A20 a in which the operationalverification has already been completed, or the communication log of thesecond block B20 b targeted for the operational verification. Thecommunication log acquiring unit 41 outputs the communication log to beacquired to the communication log shaping unit 42. The communication logacquiring unit 41 acquires the communication log that has not beenacquired yet, from the communication log group (see the reference number“LG” in FIG. 4) in the storage device of the server included in thefirst block A20 a, in which the operational verification has alreadybeen completed, prior to the operational verification for the secondblock B20 b. Also, at the time of the operational verification, thecommunication log acquiring unit 41 acquires the communication log thathas not been acquired yet, from the communication log group (see thereference number “LG” in FIG. 4) stored in the storage device of theserver included in the second block B20 b targeted for the operationalverification.

Step S2: the communication log shaping unit 42 determines whether acommunication log, in which IP addresses respectively correspond to theIP address of the transmission source and IP address of the transmissiondestination in the communication log to be acquired, has already beenstored in the communication log database DB1.

Specifically, when the communication log acquiring unit 41 acquires thecommunication log of the first block A20 a in which the operationalverification has already been completed, the communication log shapingunit 42 determines whether a communication log, in which the IPaddresses respectively correspond to the IP addresses of thetransmission source and IP address of the transmission destination inthe communication log to be acquired, has already been stored in thecommunication log table T1 a. In contrast, when the communication logacquiring unit 41 acquires the communication log of the second block B20b targeted for the operational verification, the communication logshaping unit 42 determines whether a communication log, in which the IPaddresses respectively correspond to the IP addresses of thetransmission source and IP address of the transmission destination inthe communication log to be acquired, has already been stored in thecommunication log table T1 b.

When the communication log shaping unit 42 determines that thecommunication log, in which the IP addresses respectively correspond tothe IP address of the transmission source and IP address of thetransmission destination in the communication log to be acquired, hasnot already been stored in the communication log database DB1 (Step S2,NO), the process proceeds to Step S3.

Step S3: the communication log shaping unit 42 stores the communicationlog acquired by the communication log acquiring unit 41 in thecommunication log database DB1. Specifically, when the communication logacquiring unit 41 acquires the communication log of the first block A20a in which the operational verification has already been completed, thecommunication log shaping unit 42 stores the IP address of thetransmission source, the IP address of the transmission destination, theport number of the transmission source, and the port number of thetransmission destination in the communication log to be acquired, in thecommunication log table T1 a.

In contrast, at the Step S2, when the communication log shaping unit 42determines that a communication log, in which the IP addressesrespectively correspond to the IP address of the transmission source andIP address of the transmission destination in the communication logacquired by the communication log acquiring unit 41, has already beenstored in the communication log database DB1 (Step S2, YES), the processproceeds to Step S4.

Step S4: the communication log shaping unit 42 determines whether acommunication log, in which a port number corresponds to any of the portnumber of the transmission source and the port number of thetransmission destination in the communication log acquired by thecommunication log acquiring unit 41, has already been stored in thecommunication log database DB1. Specifically, when the communication logacquiring unit 41 acquires the communication log of the first block A20a, the communication log shaping unit 42 determines whether acommunication log, in which a port number corresponds to any of the portnumber of a transmission source and the port number of a transmissiondestination in the communication log to be acquired, has already beenstored in the communication log table T1 a in FIG. 6. In contrast, whenthe communication log acquiring unit 41 acquires the communication logof the second block B20 b, the communication log shaping unit 42determines whether a communication log, in which a port numbercorresponds to any of the port number of a transmission source and theport number of a transmission destination in the communication log to beacquired, has already been stored in the communication log table T1 b inFIG. 7.

At the Step S4, when the communication log shaping unit 42 determinesthat the communication log, in which the port number corresponds to anyof the port number of the transmission source and the port number of thetransmission destination in the communication log acquired by thecommunication log acquiring unit 41, has already been stored in thecommunication log database DB1 (Step S4, YES), the process proceeds toStep S5. Hereinafter, in the communication logs that have already beenstored in the communication log database DB1, the communication log, ofwhich the IP addresses respectively correspond to the IP addresses ofthe transmission source and the transmission destination in thecommunication log acquired by the communication log acquiring unit 41and the port number corresponds to any of the port number of thetransmission source and the port number of the transmission destinationin the communication log acquired by the communication log acquiringunit 41, is appropriately referred to as a merging source communicationlog.

Step S5: the communication log shaping unit 42 merges the merging sourcecommunication log, which has already been stored in the communicationlog database DB1, with the communication log acquired by thecommunication log acquiring unit 41. The merging of the twocommunication logs at the Step S5 will specifically be described in FIG.19.

At the Step S4, when the communication log shaping unit 42 determinesthat the communication log, in which the port number corresponds to anyof the port number of the transmission source and the port number of thetransmission destination in the communication log acquired by thecommunication log acquiring unit 41, has not been stored in thecommunication log database DB1 (Step S4, NO), the process proceeds toStep S3.

When the communication log shaping unit 42 acquires a plurality ofcommunication logs at the Step S1, as is illustrated at the loops LP1and LP2, the communication log shaping unit 42 executes the processingat the Steps S1 to S5 with respect to each communication log acquired bythe communication log acquiring unit 41.

FIG. 11 is a diagram to describe the acquisition processing and themerging processing of the communication logs. In FIG. 11, acommunication log TM1 a is the communication log of the first block A20a, which is acquired by the communication log acquiring unit 41. Acommunication log TM2 a is the communication log of the first block A20a, which is acquired by the communication log acquiring unit 41 afterthe acquisition of the communication log TM1 a. The communication logsTM1 a and TM2 a are represented in a table format. Further, in FIG. 11,a merge communication log TM3 a is a diagram illustrating a state wherethe communication logs TM1 a and TM2 a are merged by the communicationlog shaping unit 42, in a table format.

The flow of the processing in FIG. 10 will specifically be describedreferring to FIGS. 6, 10, and 11. The communication log acquiring unit41, for example, acquires the first and second communication logs from acertain server (for example, the image administration server 212) in theblock administration server group 21 of the first block A20 a (Step S1in FIG. 10).

The first communication log, for example, is the communication log TM1 ain FIG. 11. The communication log TM1 a is a communication log thatincludes the IP address “192. 168. 1. 26” of the transmission source,the port number “58394” of the transmission source, the IP address “192.168. 1. 37” of the transmission destination, and the port number “25” ofthe transmission destination. The second communication log, for example,is the communication log TM2 a in FIG. 11. The communication log TM2 ais a communication log that includes the IP address “192. 168. 1. 26” ofthe transmission source, the port number “58413” of the transmissionsource, the IP address “192. 168. 1. 37” of the transmissiondestination, and the port number “25” of the transmission destination.

Herein, when the communication log, in which the IP addressesrespectively correspond to the IP address “192. 168. 1. 26” of thetransmission source, and the IP address “192. 168. 1. 37” of thetransmission destination in the communication log TM1 a, has not beenstored in the communication log table T1 a of the communication logdatabase DB1 in FIG. 9 (Step S2, NO), the communication log shaping unit42 executes the following processing. That is, as is illustrated in thecommunication log TM1 a in FIG. 11, the communication log shaping unit42 stores the communication log TM1 a in the communication log table T1a of the communication log database DB1 (Step S3).

Subsequently, the processing returns from the loop LP2 to the loop LP1and proceeds to the Step S2. At the Step S2, when the communication logshaping unit 42 determines that the communication log, in which the IPaddresses respectively correspond to the IP address of the transmissionsource and the IP address of the transmission destination in thecommunication log TM2 a, has already been stored in the communicationlog database DB1 (Step S2, YES), the processing proceeds to the Step S4.In this case, the communication log TM1 a is the merging sourcecommunication log.

The reason for “YES” determined at the Step S2 is given in that the IPaddress (“192. 168. 1. 26”) of the transmission source and the IPaddress (“192. 168. 1. 37”) of the transmission destination arerespectively corresponded in the communication log TM2 a and thecommunication log TM1 a, and further, the communication log TM1 a hasbeen stored in the communication log database DB1.

At the Step S4, when the communication log shaping unit 42 determinesthat the communication log, in which the port number corresponds to anyof the port number of the transmission source and the port number of thetransmission destination in the communication log TM2 a, has alreadybeen stored in the communication log database DB1 (Step S4, YES), theprocess proceeds to the Step S5. The reason for “YES” determined at theStep S4 is given in that the port number (“25”) of the transmissiondestination in the communication log TM1 a corresponds to the portnumber of the transmission destination in the communication log TM2 a.

The communication log shaping unit 42 merges the communication log TM1a, which has already been stored in the communication log database DB1,with the communication log TM2 a (Step S5). At the Step S5, thecommunication log shaping unit 42 merges the port number “58394” of thetransmission source in the communication log TM1 a with the port number“58413” of the transmission source in the communication log TM2 a. Themerged state is represented in the merge communication log TM3 a in FIG.11. Herein “*****” in the transmission-source port number column in themerge communication log TM3 a schematically illustrates a state wherethe port numbers are merged. Then, as is illustrated at the highest tieron the communication log table T1 a in FIG. 6, the communication logshaping unit 42 stores the port numbers to be merged in thecommunication log database DB1.

The merging at the Step S5 means that both communication logs that meetthe conditions (Step S2, Step S4, YES) described in the Step S2 and theStep S4 in FIG. 10 are integrated en masse, as one communication log.

Specifically, with regards to the merging at Step S5, when the portnumber of the transmission source of the merging source communicationlog corresponds to the port number of the transmission source of thecommunication log to be acquired, the port number of the transmissionsource of the merging source communication log is converted intoarbitrary character strings (for example, “*****”). Also, with regardsto the merging, when the port number of the transmission destination ofthe merging source communication log corresponds to the port number ofthe transmission destination of the communication log to be acquired,the port number of the transmission destination of the merging sourcecommunication log is converted into arbitrary character strings. Inplace of these character strings, the port number of the transmissiondestination of the merging source communication log may be convertedinto arbitrary numerical values (for example, 0xFFFFF (hexadecimalnumber)).

As is described in FIGS. 10 and 11, when the following conditions aresatisfied, the communication log shaping unit 42 integrates two firstcommunication logs (communication logs of the first block A20 a) intoone first communication log and stores the one first communication login the storage device 24. That is, the conditions mean that the IPaddresses of the transmission source and the transmission destinationincluded in the two first communication logs respectively correspond toeach other, and further that the port numbers of the transmission sourceand the transmission destination included in the two first communicationlogs respectively correspond to each other.

Also, as is described in FIGS. 10 and 11, when the following conditionsare satisfied, the communication log shaping unit 42 integrates twosecond communication logs (communication logs of the second block B20 b)into one second communication log and stores the one secondcommunication log in the storage device 24. That is, the conditions meanthat the IP addresses of the transmission source and the transmissiondestination included in the two second communication logs respectivelycorrespond to each other, and further that the port numbers of thetransmission source and the transmission destination included in the twosecond communication logs respectively correspond to each other.

Hereinafter, the reason for the merging of the communication logs willbe described. The reason for this is given in that the amount ofcommunication logs stored in the database needs to be reduced. Forexample, it is assumed that the first and second software componentsexecuted by a certain server request the third software componentexecuted by other server to perform data processing (also referred to as“service”). Herein, the third software component is a software componentthat executes the transfer processing of electronic mail based on SMTPand communicates with the first and second software components.

The first software component, for example, utilizes the port number“58394” of the transmission source and the port number “25” of thetransmission destination, thereby requesting the third softwarecomponent to transfer the electronic mail. Also, the second softwarecomponent, for example, utilizes the port number “58413” of thetransmission source and the port number “25” of the transmissiondestination, thereby requesting the third software component to transferthe electronic mail.

At the time of communication processing, because the software componentwhich requests a service utilizes a specific port number (“25” in theaforementioned example) and waits for the request for services, the portnumber of the transmission destination is fixed. In contrast, thesoftware components that request the services are normally made up of aplurality of software components, and the port numbers utilized by theplurality of software components are different. Even when the samesoftware components request the service, there is a case where adifferent port number is utilized every time the service is requested.In other words, the port numbers of the transmission source arefrequently changed.

Further, there is a case where the software component which requests aservice transmits the response message to the different softwarecomponents that request the service. It is noted that the responsemessage is also recorded as a communication log. Thus, when the softwarecomponents that request the service transmits the response message tothe different software components for which the service is requested,the port numbers of the transmission source are identical, but the portnumbers of the transmission destination are respectively different.

Thus, there occurs the communication processing wherein unspecific portnumbers are utilized as the port numbers of the transmission source, andspecific port numbers are utilized as the port numbers of thetransmission destination. Also, there is a case where there occurs thecommunication processing wherein specific port numbers are utilized asthe port numbers of the transmission source, and unspecific port numbersare utilized as the port numbers of the transmission destination.Accordingly, regarding the merging of the communication logs, in a statewhere the unspecific port numbers are merged, the communication logs arestored in the communication log database DB1. This merging allows theamount of data for the communication logs stored in the communicationlog database DB1 to be reduced. Also, as for the later-describedcomparison of the communication logs, it is possible to rapidly executethe comparison process.

Subsequently, the communication log comparing unit 43 executes thecomparison of the communication logs, and the error detecting unit 44executes the detection of setting errors related to communications.

(Conversion of IP Addresses of Communication Log)

The communication log comparing unit 43 executes the conversion of IPaddresses of the communication logs based on the server correspondencetable TR1 in FIG. 8, in order to execute the detection of setting errorswith high accuracy, prior to the detection of setting errors associatedwith communications.

As described above, the server correspondence table TR1 stores the IPaddresses which are set in the devices of the first device group, inwhich the operational verification has already been completed, and theIP addresses which are set in the devices of the second device groupwhich has same function as that of the devices of the first device groupand which is a target of the operational verification.

In the operation verification, the communication log comparing unit 43compares the first communication log which exists in the first devicegroup, in which the operational verification has already been completed,with the second communication log which exists in the second devicegroup which is a target of the operational verification, and determineswhether both of the first and second communication logs have samecontent. The communication log comparing unit 43 compares the IP addressincluded in the first communication log with the IP address included inthe second communication log and determines whether both of IP addressis matched in a front portion of the comparison.

When the IP address which is set in the first device group, in which theoperational verification has already been completed, corresponds withthe IP address which is set in the devices of the second device group,which has same function as that of the devices of the first device groupand which is a target of the operational verification, one by one whendetermining whether first and second communication logs is matched, itis possible to execute the determination with a high accuracy. Themeaning that the IP address which is set in the first device group, inwhich the operational verification has already been completed,corresponds with the IP address which is set in the devices of thesecond device group, which is a target of the operational verification,one by one, is that both of IP addresses just match each other.

However, as described above, the administrator sets the customizedvarious set information (for example, IP address) to the devices in thesecond device group which is a target of the operation verification.That is, there is a case that the IP address which is set in the firstdevice group, in which the operational verification has already beencompleted, does not match to the IP address which is set in the devicesof the second device group, which has same function as that of thedevices of the first device group and which is a target of theoperational verification.

Accordingly, the communication log comparing unit 43 executes aconversion process of the IP address so that the IP address which is setin the first device group, in which the operational verification hasalready been completed, matches to the IP address which is set in thedevices of the second device group, which has same function as that ofthe devices of the first device group and which is a target of theoperational verification, as described below.

That is, the communication log comparing unit 43 converts the IPaddresses of the transmission source and the transmission destination inthe first communication log into the IP addresses that are set in thedevices of the second device group targeted for the operationalverification, corresponding to the IP addresses of the transmissionsource and the transmission destination, based on the servercorrespondence table TR1. The conversion processing will specifically bedescribed referring to FIG. 12. The communication log comparing unit 43may convert the IP addresses of the transmission source and thetransmission destination in the second communication log into the IPaddresses that are set in the devices of the first device group in whichthe operational verification has already been completed, correspondingto the IP addresses of the transmission source and the transmissiondestination, based on the server correspondence table TR1.

FIG. 12 is a table to describe the conversion processing of thecommunication logs. The conversion processing of the communication logswill be described referring to FIGS. 6, 8, and 12. Firstly, thecommunication log comparing unit 43 reproduces copies of thecommunication log table in FIG. 6 and produces a correspondence presencecolumn in which a flag is stored, on the right side of thetransmission-destination port number column. A table including thecorrespondence presence column is illustrated as a master communicationlog table T1 m in FIG. 12. A reference number Tm in FIG. 5 illustrates astate where the communication log database DB1 in FIG. 5 stores themaster communication log table T1 m in FIG. 12.

Subsequently, the communication log comparing unit 43 selects an IPaddress to be converted one by one on the diagram from the IP addressesof the transmission source, which are stored in the transmission-sourceIP address column of the master communication log table T1 m in FIG. 12.The communication log comparing unit 43 searches an IP address thatcorresponds to the selected IP address, from the IP addresses which arestored in the IP address (first block A) column of the servercorrespondence table TR1 in FIG. 8.

Then, the communication log comparing unit 43 specifies an IP address onthe same line as that of the IP address to be searched, from the IPaddresses which are stored in the IP address (second block B) column ofthe server-accessible table TR1 in FIG. 8. That is, the communicationlog comparing unit 43 specifies the IP addresses in the IP address(second block B) column, corresponding to the IP address to be searched.Then, the communication log comparing unit 43 converts the IP addressselected in the master communication log table T1 m in FIG. 12 into theIP address to be specified. The communication log comparing unit 43executes the conversion of the IP addresses in the transmission-sourceIP address column of the master communication log table T1 m in FIG. 12,for example, in such a manner that the IP address “12. 0. 3. 6” isconverted into the IP address “12. 4. 3. 6”.

The communication log comparing unit 43 executes the selectionprocessing, the search processing, the specifying processing, and theconversion processing of the aforementioned IP addresses with respect toall the IP addresses of the transmission sources stored in thetransmission-source IP address column. When the IP address to beselected and the IP address to be specified are identical, thecommunication log comparing unit 43 does not have to execute theaforementioned conversion.

Further, the communication log comparing unit 43 selects an IP addressto be converted one by one on the diagram from the IP addresses of thetransmission destination, which are stored in thetransmission-destination IP address column of the master communicationlog table T1 m in FIG. 12. The communication log comparing unit 43searches an IP address that corresponds to the selected IP address, fromthe IP addresses which are stored in the IP address (first block A)column of the server correspondence table TR1 in FIG. 8. Then, thecommunication log comparing unit 43 specifies an IP address on the sameline as that of the IP address to be searched, from the IP addresseswhich are stored in the IP address (second block B) column of the servercorrespondence table TR1 in FIG. 8. Then, the communication logcomparing unit 43 converts the IP address selected in the mastercommunication log table T1 m in FIG. 12 into the IP address to bespecified. The communication log comparing unit 43 executes theconversion of the IP addresses in the transmission-destination IPaddress column of the master communication log table T1 m in FIG. 12,for example, in such a manner that the IP address “12. 0. 0. 5” isconverted into the IP address “12. 4. 0. 5”, and the IP address “12. 4.3. 7” is converted into the IP address “12. 0. 3. 7”.

The communication log comparing unit 43 executes the selectionprocessing, the search processing, the specifying processing, and theconversion processing of the aforementioned IP addresses with respect toall the IP addresses of the transmission destinations stored in thetransmission-destination IP address column. “Presence” of the flagstored in the correspondence presence column in FIG. 12 will bedescribed in FIGS. 16 and 17. It is noted that the communication logcomparing unit 43 does not have to execute the aforementionedconversion, in order to restrain an increase in processing load due toconversion processing.

(Addition of Correspondence Presence Column)

FIG. 13 is a diagram to describe a communication log table wherein thecorrespondence presence column is added to the communication log tableT1 b in FIG. 7. The communication log comparing unit 43 produces thecorrespondence presence column in which a flag is stored, on the rightside of the state column of the communication log table T1 b in FIG. 7.A table including the correspondence presence column is illustrated as acommunication log table T11 b in FIG. 13. Herein, “presence” of the flagis not stored at the time of producing the correspondence presencecolumn. “Presence” of the flag stored in the correspondence presencecolumn in FIG. 12 will be described in FIGS. 16 and 17. A referencenumber Ts in FIG. 5 illustrates a state where the communication logdatabase DB1 in FIG. 5 stores the communication log table T11 b.

(Detection Processing for Setting Error)

FIG. 14 is a first flowchart to describe the entire flow of thecomparison processing of the communication logs and the detectionprocessing for the setting errors.

Step S11: the communication log comparing unit 43 reads out the entirecommunication logs which serve as a master (reference) for thecomparison processing from the communication log database DB1.Hereinafter, the communication log that serves as the master isappropriately referred to as a master communication log. Specifically,the communication log comparing unit 43 reads out the specificinformation (the IP addresses of the transmission source and thetransmission destination and the port numbers of the transmission sourceand the transmission destination) of the entire communication logsstored in the master communication log table T1 m in FIG. 12.

Step S12: the communication log comparing unit 43 reads out thecommunication log targeted for the operational verification, from thecommunication log database DB1. The communication log targeted for theoperational verification is the communication log of the second blockB20 b. Specifically, the communication log comparing unit 43 reads outthe specific information of the communication log, which has not beenread out yet, from the specific information of the communication logsstored in the communication log table T11 b in FIG. 13.

Step S13: the communication log comparing unit 43 compares thecommunication log targeted for the operational verification, which isread out at the Step S12, with each master communication log, and sets aflag, which indicates that both communication logs correspond to eachother, to respective communication logs. The processing at the Step S13will be described in detail in FIG. 15. The communication log comparingunit 43 executes the processing of comparing the communication logtargeted for the operational verification, which is read out at the StepS12, with each master communication log, with respect to the entiremaster communication logs (loops LP 21 to LP22).

Step S14: the error detecting unit 44 detects the setting error relatedto communications, and the notifying unit 45 notifies the administratorof the setting error related to communications, which is detected by theerror detecting unit 44.

The communication log comparing unit 43 executes the processing at theStep S12 and Step S13 until the communication log comparing unit 43reads out all the communication logs from the communication log tableT11 b in FIG. 13 at the Step S12 (loops LP11 to LP12).

FIG. 15 is a flowchart to describe the comparison of the communicationlogs and the detection of the setting error at the Step S13 in FIG. 14.

Step S131: the communication log comparing unit 43 determines whetherthe IP addresses of the transmission source and the transmissiondestination of the master communication log respectively correspond tothe IP addresses of the transmission source and the transmissiondestination of the communication log targeted for the operationalverification. When the IP addresses of the transmission source and thetransmission destination in the master communication log do notcorrespond to the IP addresses of the transmission source and thetransmission destination of the communication log targeted for theoperational verification (S131, NO), the processing proceeds to the loopLP22 in FIG. 14. In contrast, the IP addresses of the transmissionsource and the transmission destination of the master communication logrespectively correspond to the IP addresses of the transmission sourceand the transmission destination of the communication log targeted forthe operational verification (Step S131, YES), the processing proceedsto the Step S132.

Step S132: the communication log comparing unit 43 determines whetherthe port number of the transmission source of the master communicationlog and the port number of the transmission source of the communicationlog targeted for the operational verification are merged, or whether theport number of the transmission destination of the master communicationlog and the port number of the transmission destination of thecommunication log targeted for the operational verification are merged.

Hereinafter, a case where the port number of the transmission source ofthe master communication log and the port number of the transmissionsource of the communication log targeted for the operationalverification are merged is referred to as a first case. Also, a casewhere the port number of the transmission destination of the mastercommunication log and the port number of the transmission destination ofthe communication log targeted for the operational verification aremerged is referred to as a second case.

Herein, in the second case (Step S132, only the port numbers of thetransmission destination are merged), the processing proceeds to theStep S133. In the first case, (Step S132, only the port numbers of thetransmission source are merged), the processing proceeds to the StepS134. In a third case where the first and second cases are not applied,the processing proceeds to the Step S133. In a case where any of thefirst to third cases are not applied, the processing proceeds to theloop LP22 in FIG. 14.

Step S133: the communication log comparing unit 43 determines whetherthe port number of the transmission source of the master communicationlog corresponds to the port number of the transmission source of thecommunication log targeted for the operational verification. When theport number of the transmission source of the master communication logcorresponds to the port number of the transmission source of thecommunication log targeted for the operational verification (Step S133,YES), the process proceeds to the Step S135. In contrast, when the portnumber of the transmission source of the master communication log doesnot correspond to the port number of the transmission source of thecommunication log targeted for the operational verification (Step S133,NO), the process proceeds to the Step S134.

Step S134: the communication log comparing unit 43 determines whetherthe port number of the transmission destination of the mastercommunication log corresponds to the port number of the transmissiondestination of the communication log targeted for the operationalverification. When the port number of the transmission destination ofthe master communication log does not correspond to the port number ofthe transmission destination of the communication log targeted for theoperational verification (Step S134, NO), the process proceeds to theloop LP22 in FIG. 14. In contrast, when the port number of thetransmission destination of the master communication log corresponds tothe port number of the transmission destination of the communication logtargeted for the operational verification (Step S134, YES), the processproceeds to the Step S135.

Step S135: the communication log comparing unit 43 sets a flag, whichindicates that there exist communication logs that correspond to eachother, in the communication logs that correspond to each other. Thecommunication logs that correspond to each other include the mastercommunication log and the communication log targeted for the operationalverification, both of which satisfy the condition at the Step S131 (StepS131, YES) and the condition at the Step S133 or the Step S134 (StepS133, YES or Step S134, YES).

(Setting for Flag)

The setting for the flag described in FIG. 15 will be describedreferring to FIGS. 16 and 17. FIG. 16 is a diagram to describe thecorrespondence and non-correspondence between the communication logs ina state where the port number of the transmission source and the portnumber of the transmission destination are both merged.

A communication log TC31 a is the master communication log illustratedby a reference number “P1” in FIG. 12. A communication log TC31 b is thecommunication log targeted for the operational verification, which isillustrated by the reference number “P1” in FIG. 13. A communication logTC32 a is the master communication log illustrated by a reference number“P2” in FIG. 12. A communication log TC32 b is the communication logtargeted for the operational verification, which is illustrated by thereference number “P2” in FIG. 13. A communication log TC33 a is themaster communication log illustrated by a reference number “P3” in FIG.12. A communication log TC33 b is the communication log targeted for theoperational verification, which is illustrated by the reference number“P3” in FIG. 13.

The communication log comparing unit 43, for example, compares thecommunication log TC31 a with the communication log TC31 b. Herein, theIP addresses of the transmission source (“192. 168. 1. 26”) and thetransmission destination (“192. 168. 1. 37”) included in thecommunication log TC31 a respectively correspond to the IP addresses ofthe transmission source and the transmission destination included in thecommunication log TC31 b. Also, the port numbers of the transmissionsource included in the communication logs TC31 a and TC31 b are merged(“*****”). Then, the port number (“25”) of the transmission destinationincluded in the communication logs TC31 a corresponds to the port number(“25”) of the transmission destination included in the communicationlogs TC31 b. Accordingly, regarding to the aforementioned comparison ofthe communication logs, the communication log comparing unit 43determines that a decision is YES at the Step S131, and that only theport number of the transmission source is merged at the Step S132, andthat a decision is YES at the Step S134 in FIG. 15, and the processproceeds to the Step S135.

With respect to the correspondence presence column in the mastercommunication log table T1 m in FIG. 12, the communication log comparingunit 43 stores “presence” of the flag in the corresponding line of thecommunication log TC31 a (see the reference number “P1” in FIG. 12)(Step S135).

Then, with respect to the correspondence presence column in thecommunication log table T11 b in FIG. 13, the communication logcomparing unit 43 stores “presence” of the flag in the correspondingline of the communication log TC31 b (see the reference number “P1” inFIG. 13) (Step S135).

Subsequently, the communication log comparing unit 43, for example,compares the communication log TC32 a with the communication log TC32 b.With respect to the comparison of the communication logs, thecommunication log comparing unit 43 determines that a decision is YES atthe Step S131, and that only the port number of the transmissiondestination is merged at the Step S132, and that a decision is YES atthe Step S133 in FIG. 15, and the processing proceeds to the Step S135.

With respect to the correspondence presence column in the mastercommunication log table T1 m in FIG. 12, the communication log comparingunit 43 stores “presence” of the flag in the corresponding line of thecommunication log TC32 a (see the reference number “P2” in FIG. 12)(Step S135).

Then, with respect to the correspondence presence column in thecommunication log table T11 b in FIG. 13, the communication logcomparing unit 43 stores “presence” of the flag in the correspondingline of the communication log TC32 b (see the reference number “P2” inFIG. 13) (Step S135).

The processing of the aforementioned comparison is repeatedly executed(see loops LP11 to LP12 in FIG. 14). As a result, the communication logcomparing unit 43, for example, compares the communication log TC33 awith the communication log TC33 b. Herein, the IP address (“12. 4. 3.7”) of the transmission destination included in the communication logTC33 a does not correspond to the IP address (“12. 0. 3. 7”) of thetransmission destination included in the communication log TC33 b.Accordingly, with respect to the aforementioned comparison of thecommunication logs, the communication log comparing unit 43 determinesthat a decision is NO at the Step S131 in FIG. 15 and does not executethe processing at the Step S135. As a result, with respect to thecorrespondence presence column in the master communication log table T1m in FIG. 12, the communication log comparing unit 43 does not store“presence” of the flag in the corresponding line of the communicationlog TC33 a (see the reference number P3 in FIG. 12). That is, the flagis maintained to a blank. With respect to the correspondence presencecolumn in the communication log table T11 b in FIG. 13, thecommunication log comparing unit 43 does not store “presence” of theflag in the corresponding line of the communication log TC33 b (see thereference number P3 in FIG. 13). That is, the flag is maintained to ablank.

FIG. 17 is a diagram to describe the correspondence andnon-correspondence between the communication logs in a state where theport number of the transmission source and the port number of thetransmission destination are not both merged.

Communication logs TC41 a to TC43 a are represented as one example ofthe master communication log. Communication logs TC41 b to TC43 b arerepresented as one example of the communication log targeted for theoperational verification.

The communication log comparing unit 43, for example, compares thecommunication log TC41 a with the communication log TC41 b. Herein, theIP address (“192. 168. 1. 37”) of the transmission source and the IPaddress (“192. 168. 1. 35”) of the transmission destination included inthe communication log TC41 a respectively correspond to the IP addressof the transmission source and the IP address of the transmissiondestination included in the communication log TC41 b. Then, the portnumber (“53641”) of the transmission source and the port number (“80”)of the transmission destination included in the communication log TC41 arespectively correspond to the port number of the transmission sourceand the port number of the transmission destination included in thecommunication log TC41 b. Accordingly, with respect to theaforementioned comparison of the communication logs, the communicationlog comparing unit 43 determines that a decision is YES at the StepS131, and a decision is NO at the Step S132, and a decision is YES atthe Step S133 in FIG. 15, and the processing proceeds to the Step S135.

With respect to the correspondence presence column in the mastercommunication log table T1 m in FIG. 12, the communication log comparingunit 43 stores “presence” of the flag in the corresponding line (notillustrated) of the communication log TC41 a (Step S135). Then, withrespect to the correspondence presence column in the communication logtable T11 b in FIG. 13, the communication log comparing unit 43 stores“presence” of the flag in the corresponding line (not illustrated) ofthe communication log TC41 b (Step S135).

The communication log comparing unit 43, for example, compares thecommunication log TC42 a with the communication log TC42 b. Herein, theIP address (“192. 168. 1. 37”) of the transmission source and the IPaddress (“192. 168. 1. 35”) of the transmission destination included inthe communication log TC42 a respectively correspond to the IP addressof the transmission source and the IP address of the transmissiondestination included in the communication log TC42 b. In contrast, theport number (“53641”) of the transmission source included in thecommunication log TC42 a does not correspond to the port number(“53645”) of the transmission source included in the communication logTC42 b. However, the port number (“80”) of the transmission destinationincluded in the communication log TC42 a corresponds to the port number(“80”) of the transmission destination included in the communication logTC42 b.

Accordingly, with respect to the aforementioned comparison of thecommunication logs, the communication log comparing unit 43 determinesthat a decision is YES at the Step S131, and a decision is NO at theStep S132 and the Step S133, and a decision is YES at the Step S134 inFIG. 15, and the processing proceeds to the Step S135. The processing atthe Step S135 has been described in the case of the comparison of thecommunication log TC42 a with the communication log TC42 b, so that itsdescription is omitted.

The communication log comparing unit 43, for example, compares thecommunication log TC43 a with the communication log TC43 b. Herein, theIP address (“192. 168. 1. 37”) of the transmission source and the IPaddress (“192. 168. 1. 35”) of the transmission destination included inthe communication log TC43 a respectively correspond to the IP addressof the transmission source and the IP address of the transmissiondestination included in the communication log TC43 b. However, the portnumber (“53641”) of the transmission source included in thecommunication log TC43 a does not correspond to the port number(“53645”) of the transmission source included in the communication logTC43 b. Further, the port number (“80”) of the transmission destinationincluded in the communication log TC43 a does not correspond to the portnumber (“443”) of the transmission destination included in thecommunication log TC43 b.

Accordingly, with respect to the aforementioned comparison of thecommunication logs, the communication log comparing unit 43 determinesthat a decision is YES at the Step S131 and that a decision is NO at theSteps S132 to S134 in FIG. 15, and does not execute the processing atthe Step S135.

As is described above, the communication log comparing unit 43 repeatsthe aforementioned comparison of the master communication log with thecommunication log targeted for the operational verification.Specifically, the communication log comparing unit 43 reads out theentire master communication logs stored in the master communication logtable T1 m in FIG. 12. Then, the communication log comparing unit 43compares the master communication log to be read out with eachcommunication log stored in the communication log table T11 b in FIG.13. When the master communication log to be read out corresponds to eachcommunication log stored in the communication log table T11 b, thecommunication log comparing unit 43 stores “presence” of the flag in thecorresponding line of the communication logs which correspond to eachother, with respect to the correspondence presence columns in thecommunication log tables T1 m and T11 b.

(Extract of Setting Error Candidate)

According to the execution of the processing at the Steps S11 to S13 inFIG. 14, the communication log comparing unit 43 stores the flag in thecorrespondence presence column in the master communication log table T1m in FIG. 12 and further stores the flag in the correspondence presencecolumn in the communication log table T11 b in FIG. 13. Then, theprocessing proceeds from the loop LP12 to the Step S14 in FIG. 14.

The error detecting unit 44 extracts a setting error candidate based onthe master communication log table T1 m in FIG. 12 and the communicationlog table T11 b in FIG. 13. The communication log of the setting errorcandidate is a communication log stored in a line (blank) in which“presence” of the flag is not stored with respect to the correspondencepresence columns of the master communication log table T1 m in FIG. 12and the communication log table T11 b in FIG. 13. Also, thecommunication log of the setting error candidate is a communication logstored in a line in which “no response” is stored with respect to thestate column of the communication log table T11 b in FIG. 13.

The error detecting unit 44 detects the setting error based on thesetting error candidate to be extracted and analyzes the cause of thesetting error. Then, the notifying unit 45 notifies the administrator ofthe content of the setting error and the cause of the setting error.First, the extraction of the setting error candidate will be describedbased on FIG. 18.

FIG. 18 is a diagram to describe the extraction of the setting errorcandidate, which is executed at the Step S14 in FIG. 14.

The error detecting unit 44 extracts the setting error candidate as apreliminary stage of the detection of the setting error. The errordetecting unit 44 detects the communication log that does not correspondto the second specific information included in the plurality of secondcommunication logs (see FIG. 13), from the plurality of firstcommunication logs (see FIG. 12), as a communication log having thesetting error.

Specifically, the error detecting unit 44 detects the communication login which the IP addresses do not correspond to the IP addresses of thetransmission source and the transmission destination included in theplurality of second communication logs, from the plurality of firstcommunication logs, as the communication log having the first settingerror. Similarly, the error detecting unit 44 detects the communicationlog in which IP addresses respectively correspond to the IP addresses ofthe transmission source and the transmission destination included in theplurality of second communication logs, and in which port numbers do notcorrespond to the port numbers of the transmission source and thetransmission destination included in the plurality of secondcommunication logs, from the plurality of first communication logs, asthe communication log having the first setting error. Hereinafter, thecommunication log having the first setting error is appropriatelyreferred to as a communication log of the first setting error candidate.

In the example of FIG. 12, the error detecting unit 44 extracts thecommunication log of the first setting error candidate from thecommunication log group stored by the master communication log table T1m in FIG. 12. The communication log of the first setting error candidateis a communication log in which “presence” of the flag is not stored inthe correspondence presence column. A reference number “TE1 a” in FIG.18A illustrates a table representing two communication logs of the firstsetting error candidate, which is extracted by the error detecting unit44.

Further, the error detecting unit 44 detects the communication log inwhich IP addresses do not correspond to the IP addresses of thetransmission source and the transmission destination included in theplurality of first communication logs, from the plurality of secondcommunication logs, as the communication log having the second settingerror. Similarly, the error detecting unit 44 detects the communicationlog in which IP addresses respectively correspond to the IP addresses ofthe transmission source and the transmission destination included in theplurality of first communication logs, but in which port numbers do notcorrespond to the port numbers of the transmission source and thetransmission destination included in the plurality of firstcommunication logs, from the plurality of second communication logs, asthe communication log having the second setting error. Hereinafter, thecommunication log having the second setting error is appropriatelyreferred to as a communication log of second setting error candidate.

In the example of FIG. 13, the error detecting unit 44 extracts thecommunication log of the second setting error candidate from thecommunication log group stored by the communication log table T11 b inFIG. 13. The communication log of the second setting error candidate isa communication log in which “presence” of the flag is not stored in thecorrespondence presence column. Further, the error detecting unit 44detects (also referred to as “extract”) a second communication logincluding communication information indicating that the communicationstate information is not normally executed, for example, a communicationlog in which “no response” is stored in the state column.

A reference number “TE1 b” in FIG. 18B illustrates a table representingthe communication log of the second setting error candidate, which isextracted by the error detecting unit 44, and the second communicationlog including the communication information indicating that thecommunication state information is not normally executed.

Then, the error detecting unit 44 detects the setting error in thespecific information that specifies the transmission source and thetransmission destination, which is associated with the communicationlogs of the first and second setting errors, with regards to the devicesof the second device group.

FIGS. 19 to 21 are the first to third diagrams to describe the detectionprocessing for the setting errors, which is executed at the Step S14 inFIG. 14.

The error detecting unit 44 separately executes the first to thirddetection processing, thereby detecting the setting errors. Firstly, thefirst detection processing will be described.

Regarding the first detection processing, the following presumption willbe applied. The administrator sets the IP address “12. 3. 0. 142” of thetransmission source in the server (hereinafter, referred to as “serverS1”) of the first device group in which the operational verification hasalready been completed (for example, the first block A20 a). Further,the administrator sets the IP address “12. 0. 3. 7” of the transmissiondestination to the communication software component executed by theserver S1. Herein, the server of the transmission destination, in whichthe IP address “12. 0. 3. 7” of the transmission destination is set, isreferred to as a server D1.

Then. the administrator sets the IP address “12. 3. 0. 142” of thetransmission source in the server (hereinafter, referred to as “serverS2”), which has the same function as that of the server S1, in thesecond device group targeted for the operational verification (forexample, the second block B20 b). Then, it is assumed that theadministrator needs to set the IP address “12. 4. 3. 7”, which is aproduct of the customization of the IP address “12. 0. 3. 7” of thetransmission destination, to the communication software componentexecuted by the server S2. However, the administrator actually does notcarry out the aforementioned customization and erroneously sets the IPaddress “12. 0. 3. 7” of the transmission destination, in place of theIP address“12. 4. 3. 7”. Herein, the server of the transmissiondestination, in which the IP address “12.4. 3. 7” of the transmissiondestination is set, is referred to as a server D2.

In the server correspondence table TR1 in FIG. 8, the IP address “12. 0.3. 7” and the IP address “12. 4. 3. 7” are respectively stored on thesame line in the IP address (the first block A) column and the IPaddress (the second block B) column. In other words, the server D1 andthe server D2 have the same functions.

When the administrator executes the operational verification for thesecond device group targeted for the operational verification, thecommunication software component of the server S2 generatescommunication packets and transmits the communication packets. Thecommunication packets, for example, include the IP address “12. 3. 0.142” of the transmission source, the port number “9000” of thetransmission source, the IP address “12. 0. 3. 7” (erroneous setting) ofthe transmission destination, and a predetermined port number of thetransmission destination. The IP address “12. 0. 3. 7” (erroneoussetting) of the transmission destination in the communication packets isnot stored in the IP address (the second block B) column in the servercorrespondence table TR1 in FIG. 8. Accordingly, the communicationpackets are transmitted to a block (for example, the first block A20 a)except for the second block B20 b, and the server of the block receivesthe communication packets. Then, the server that received thecommunication packets returns an affirmative response packet (alsoreferred to as ACK packet) to the communication software component ofthe server S2. As a result, the communication software component of theserver S2 stores the communication log that includes the IP address “12.3. 0. 142” of the transmission source, the port number “9000” of thetransmission source, the IP address “12. 0. 3. 7” (erroneous setting) ofthe transmission destination, the predetermined port number of thetransmission destination, and a communication state “OK” (see thereference number TE1 b in FIG. 18B).

The communications described above are attributed to the erroneoussetting for the IP addresses, so that it is requisite to correct theerroneous setting for the IP addresses. Accordingly, the error detectingunit 44 of the administration device 4 executes the followingprocessing.

The error detecting unit 44 detects a communication log in which its IPaddress corresponds to the IP address of the transmission source, andits port number corresponds to the port number of the transmissionsource, as the communication log of the third setting error, from thecommunication log of the first setting error and the communication logof the second setting error. Otherwise the error detecting unit 44detects a communication log in which its IP address corresponds to theIP address of the transmission destination, and its port numbercorresponds to the port number of the transmission destination, as thecommunication log of the fourth setting error.

Then, the error detecting unit 44 detects the setting error regardingthe IP addresses of the transmission source and the transmissiondestination, which is associated with the communication logs of thethird and fourth setting errors, with regards to the devices of thesecond device group. Then, the notifying unit 45 notifies theadministrator of the setting error detected by the error detecting unit44.

Hereinafter, specific embodiments will be described. The error detectingunit 44 compares the communication log of the first setting errorcandidate with the communication log of the second setting errorcandidate. Then, the error detecting unit 44 extracts a communicationlog in which its IP address corresponds to the IP address of thetransmission source, and its port number corresponds to the port numberof the transmission source, or a communication log in which its IPaddress corresponds to the IP addresses of the transmission destination,and its port number corresponds to the port number of the transmissiondestination, from the communication logs of the first and second settingerror candidates. In the case exemplified in FIG. 18A and FIG. 18B, theerror detecting unit 44 extracts the communication log that includes theIP addresses “12. 3. 0. 142” of the transmission source and the portnumber “9000” of the transmission source, as the communication log inwhich its IP address corresponds to the IP addresses of the transmissionsource, and its port number corresponds to the port number of thetransmission source, from the communication logs of the first and secondsetting error candidates.

Specifically, the error detecting unit 44 extracts the communication logTM1 a in FIG. 19A from the two communication logs illustrated by thereference number “TE1 a”. The communication log TM1 a includes the IPaddresses “12. 3. 0. 142” of the transmission source, the port number“9000” of the transmission source, the IP address “12. 4. 3. 7” of thetransmission destination, and the port number “*****” of thetransmission destination. Further, the error detecting unit 44 extractsthe communication log TM1 b in FIG. 19B from the two communication logsillustrated by the reference number TE1 b. The communication log TM1 bincludes the IP addresses “12. 3. 0. 142” of the transmission source,the port number “9000” of the transmission source, the IP address “12.0. 3. 7” of the transmission destination, and the port number “*****” ofthe transmission destination.

As is described above, the IP address “12. 0. 3. 7” of the transmissiondestination included in the communication log TM1 b in FIG. 19B is notstored in the IP address (the second block B) column in the servercorrespondence table TR1 in FIG. 8. Thus, when there is an IP addressthat is not stored in the IP address (the second block B) column in FIG.8, in the IP addresses included in the communication log TM1 b in FIG.19B, the error detecting unit 44 assumes that there occurs the settingerror associated with the IP address. The IP address, for which it isassumed that the setting error occurs, is the IP address “12. 0. 3. 7”of the transmission destination.

Accordingly, the error detecting unit 44 assumes that there occurs thesetting error at the time of setting the communication associationinformation in the server in which the IP addresses “12. 3. 0. 142” ofthe transmission source in the communication log TM1 b is set. Further,the IP address “12. 0. 3. 7” of the transmission destination is storedin the IP address (the first block A) column in the servercorrespondence table TR1 in FIG. 8, so that the error detecting unit 44assumes that the IP address “12. 4. 3. 7” corresponding to the IPaddress is correct.

Then, the notifying unit 45 informs the administrator that there occursthe setting error at the time of setting the communication associationinformation in the server in which the IP addresses “12. 3. 0. 142” ofthe transmission source is set, and that the IP address “12. 4. 3. 7” isa correct IP address.

Next, the second detection processing will be described. The errordetecting unit 44 detects the communication log of the fifth settingerror except for the communication logs of the third and fourth settingerror, from the communication logs of the first setting error. Thenotifying unit 45 detects the setting error in the IP address of thetransmission source, which is associated with the communication log ofthe fifth setting error in the devices of the second device group, andinforms the administrator of the setting error to be detected.

Hereinafter, specific embodiments will be described. The error detectingunit 44 detects the presence or absence of the communication log, whichexists only in the first device group (for example, the first block A20a) in which the operational verification has already been completed. Asis described above, the hardware components and the software componentsincluded in the second device group (for example, the second block B20b) targeted for the operational verification are equal or approximatelyequal to the hardware components and the software components included inthe first block A20 a. If so, with regard to the first block A20 a andthe second block B20 b, there is a high probability that thecommunications are executed wherein the transmission source andtransmission destination are deemed to be identical.

Accordingly, when there is the communication log that exists only in thefirst block A20 a, there is a high probability that the communicationsassociated with this communication log have not been executed in thesecond block B20 b. More specifically, in the server of the transmissionsource which executes the communications associated with thiscommunication log in the second block B20 b, there is a high probabilitythat the software component, which executes the services that the serverneeds to provide, has not operated. Furthermore, there is a highprobability that there occurs the setting error such as an omission ofsetting regarding the communication setting information in the server.

Specific processing of detecting the presence or absence of thecommunication log that exists only in the first block A20 a will bedescribed. The error detecting unit 44 extracts a communication logexcept for the communication logs extracted in the first detectionprocessing, from two communication logs illustrated by the referencenumber TE1 a in FIG. 18. The communication log to be extracted isrepresented as one example of the communication log of the fifth settingerror and is exemplified by a communication log TM11 a in FIG. 20. Thecommunication log TM11 a is a communication log that includes the IPaddress “192. 168. 0. 12” of the transmission source, the port number“*****” of the transmission source, the IP address “192. 168. 1. 23” ofthe transmission destination, and the port number “9002” of thetransmission destination.

The communication log TM11 a is the communication log that exists onlyin the first block A20 a.

The notifying unit 45 informs the administrator that there occurs thesetting error associated with the communication log detected by theerror detecting unit 44. The notifying unit 45 informs the administratorthat it needs to be verified whether the software component, whichexecutes the services that the server needs to provide, is operated inthe server, in which the IP address “192. 168. 0. 12” of thetransmission source is set and executes the communications related tothis communication log in the second block B20 b. Also, the notifyingunit 45 informs the administrator that it needs to be verified whetherthe server is correct and whether the communication setting informationis correct that is set in the software component executed by the server.

Next, the third detection processing will be described. The errordetecting unit 44 extracts the communication log of second setting errorcandidate in which “no response” is stored in the state column.Regarding the communication log that stores “no response”, there is ahigh probability that the communication packets are transmitted from theserver of the transmission source to the server of the transmissiondestination, but the communication packets have not arrived at theserver of the transmission destination. As the cause of this failure,for example, it is conceivable that the firewall provided on a networkinterposed between the server of the transmission source and the serverof the transmission destination has blocked the aforementionedcommunication packets. Moreover, as another cause of this failure, it isconceivable that there occurs the setting error in a routing tableprovided in the router on the aforementioned network.

Specifically, the error detecting unit 44 extracts the communication login which “no response” is stored in the state column, from the twocommunication logs illustrated by the reference number “TE1 b” in FIG.18. The communication log to be extracted is a communication log TM11 bin FIG. 21. The communication log TM11 b includes the IP addresses “192.168. 1.37” of the transmission source, the port number “*****” of thetransmission source, the IP address “192. 168. 1. 35” of thetransmission destination, and the port number “9004” of the transmissiondestination.

According to the communication log in which “no response” is stored inthe state column, it can be assumed that there is a probability that thecommunication packets are blocked that are transmitted from the serverof the transmission source in which the IP addresses “192. 168. 1. 37”of the transmission source is set, to the port number “9004” of theserver of the transmission destination in which the IP address “192.168. 1. 35” of the transmission destination is set.

Accordingly, the notifying unit 45 informs the administrator that itneeds to be verified whether the settings are correct in the firewallarranged on the network (communication channel) from the server of thetransmission source to the server of the transmission destination.

As is described above, the administration device of the embodiment ofthe present invention not only automatically detects the setting errorin the communication related information and informs the administratorof the setting error, but also assumes the cause of the setting errorand informs the administrator of the cause of the setting error.Accordingly, it is easy for the administrator to specify the settingerror and analyze the cause of the setting error, which enhancesconvenience of the administrator. Also, the processes and time ofcorrecting the setting error can be reduced, thereby rapidly completingthe operational verification. As a result, this not only enhances theconvenience of users for the information processing system but alsoimproves the economic profits of business persons.

Also, the administration device of the embodiment executes the detectionprocessing of the setting error with the use of the IP addresses, theport numbers, and communication states of the communication logs whichare recorded in the communication processing executed by the softwarecomponents in the servers.

Accordingly, apart from the administration device, it is not requisiteto separately include complicated software components that is used todetect the setting error, thereby restraining the complication ofsystems and an increase in expense of system configuration. Moreover,the communication logs are recorded on the server, so that an increasein processing load in the server can be restrained. Also, theadministration device also obtains the communication logs and executesthe simplified processing of comparison of the communication logs to beobtained, so that an increase in processing load can be restrained.

Also, the administration device of the embodiment obtains thecommunication log that serves the master communication log in the courseof comparison of the communication logs, from the first block A20 a inoperation. Accordingly, it is possible that the administration deviceperforms the operational verification for the second block B20 b in thecourse of comparison of the communication logs, without interrupting theoperation of the first block A20 a. Therefore, it is possible that thefirst block A20 a operates during the operational verification for thesecond block B20 b, thereby continuously providing services for theusers of the cloud system.

It is noted that the administration device 4 may obtain the specificinformation that specifies the transmission source and the transmissiondestination in terms of communications, as the communication log of thefirst block A20 a, from the header information of the communicationpacket that is transmitted and received on the network of the firstblock A20 a. Similarly, the administration device 4 may obtain thespecific information that specifies the transmission source and thetransmission destination in terms of communications, as thecommunication log of the second block B20 b, from the header informationof the communication packet that is transmitted and received on thenetwork of the second block B20 b.

[Second Embodiment of Administration Device]

In the first embodiment, the first device group in which the operationalverification has already been completed is made up of one device group(the first block A20 a). In the second embodiment, in a case where thereare a plurality of device groups in which the operational verificationhas already been completed, the detection processing for the settingerror executed by the administration device 4 will be described.Preferably, when the administration device 4 detects a magnitude ofsetting errors, the administration device 4 informs the setting errorsto the administrator in accordance with priority. In other words, it ispreferable that the setting error with the high degree of importance bepreferentially informed to the administrator.

Accordingly, the administration device 4 allows the communication log,which is obtained from a plurality of first device groups in which theoperational verification has already been completed, to include a valueof certainty (hereinafter, appropriately referred to as “certainty”).More specifically, the communication log comparing unit 43 allows thefirst communication log in the plurality of first device groups toinclude the value of certainty, which indicates emergence frequency ofthe first communication log in the plurality of first device groups. Theadministration device 4 determines the priority based on the certaintyand determines the order of notification of the setting errors based onthe priority to be determined. Hereinafter, specific details will bedescribed.

(Hardware Block Diagram of Information Processing System SYS′)

FIG. 22 is a hardware block diagram of an information processing systemSYS′ that includes the plurality of first device groups in which theoperational verification has already been completed, as one example.FIG. 22 illustrates the constitution in which a third block C20 c and afourth block D20 d are added to the information processing system SYSdescribed in FIG. 1. Herein, the first block A20 a, the second block B20b, and the third block C20 c are the first device groups in which theoperational verification has already been completed (also referred to as“first device group in which the configuration has already beencompleted”). A fourth block D20 d is the second device group targetedfor the operational verification (also referred to as “the second devicegroup that is currently being configured”).

In the second embodiment, as is the same case with the first embodiment,the hardware components and the software components are equal orapproximately equal in respective blocks. Specifically, the hardwarecomponents and the software components of the first block A20 a areequal or approximately equal to the hardware components and the softwarecomponents of the second block B20 b, the third block C20 c, and thefourth block D20 d. The hardware components and the software componentsof the second block B20 b are equal or approximately equal to thehardware components and the software components of the third block C20 cand the fourth block D20 d. The hardware components and the softwarecomponents of the third block C20 c are equal or approximately equal tothe hardware components and the software components of the fourth blockD20 d.

In the second embodiment, the block administration server group 25 ofthe third block C20 c and the block administration server group 27 ofthe fourth block D20 d include servers that are equal or approximatelyequal to the servers of the block administration server group 21 of thefirst block A20 a or the block administration server group 23 of thesecond block B20 b. Then, the user server group 26 of the third blockC20 c and the user server group 28 of the fourth block D20 d includeservers that are equal or approximately equal to the servers of the userserver group 22 of the first block A20 a or the user server group 24 ofthe second block B20 b.

Hereinafter, the operation of the administration device 4 of the secondembodiment will be described. The administration device 4 includes thehardware components described in FIGS. 4 and 5 and the software modulecomponents described in FIG. 9.

(Server Correspondence Table)

FIG. 23 is a table to describe a server correspondence database DB2 inthe second embodiment. The reference number “TR” in FIG. 5 illustrates astate where the server correspondence database DB2 in FIG. 5 stores aserver correspondence table TR2. The server correspondence table TR2 isa table corresponding to the server correspondence table TR1 in FIG. 8.

The server correspondence table TR2 includes an IP address column (forfirst block A), an IP address column (for second block B), an IP addresscolumn (for third block C), and an IP address column (for fourth blockD). The IP address column (for first block A) stores IP addresses set inthe server that the first block A20 a includes. The IP address column(for second block B) stores IP addresses set in the server that thesecond block B20 b includes. The IP address column (for third block C)stores IP addresses set in the server that the third block C20 cincludes. The IP address column (for fourth block D) stores IP addressesset in the server that the fourth block D20 d includes.

The server correspondence table TR2 is one example of relatinginformation that includes the IP addresses set in the devices in theplurality of first device groups in which the operational verificationhas already been completed, and the IP addresses set in the devices,which have the same functions as those of devices in the plurality offirst device groups, in the second device group which is targeted foroperational verification.

For example, the plurality of first device groups are exemplified by thefirst block A20 a to the third block C20 c in FIG. 22. The devices ofthe first device group, for example, include the servers included in theblock administration server group 21, the servers included in the blockadministration server group 23, and the servers included in the blockadministration server group 25. Furthermore, the devices of the firstdevice group, for example, include the servers included in the userserver group 22, the servers included in the user server group 24, andthe servers included in the user server group 26.

The second device group targeted for the operational verification, forexample, is the fourth block D20 d in FIG. 22. The devices of the seconddevice group, for example, include the servers of the blockadministration server group 27 and the servers of the user server group28.

As is described in FIG. 8, in FIG. 23, each of servers, in which the IPaddress stored in the same line of the diagram and stored in each IPaddress column (the first block A to the fourth block D) is set, has thesame functions.

Herein, a server, in which the IP address “12. 0. 0. 5” stored in the IPaddress column (the first block A) is set, is referred to as “serverA1”. The server A1 and a server (hereinafter referred to as “serverB1”), in which the IP address “12. 4. 0. 5” stored in the IP addresscolumn (the second block B) is set at the same line as that of the IPaddress (“12. 0. 0. 5”) of the server A1, are servers having the similarfunctions. The server A1 and a server (hereinafter referred to as“server C1”), in which the IP address “12. 8. 0. 5” stored in the IPaddress column (the third block C) is set at the same line as that ofthe IP address (“12.0. 0. 5”) of the server A1, are servers having thesimilar functions. Further, the server A1 and a server (hereinafterreferred to as “server D1”), in which the IP address “12. 12. 0. 5”stored in the IP address column (the fourth block D) is set at the sameline as that of the IP address (“12. 0. 0. 5”) of the server A1, areservers having the similar functions.

For example, when the server A1 is the DNS server, the server B1, theserver C1, and the server D1 are also the DNS servers.

The administrator produces the server correspondence table TR2 inadvance, and stores the server correspondence table TR2 in the servercorrespondence database DB2 in FIG. 5. It is assumed that the IP addressstored in the server correspondence table TR2 is a correct IP address.It is noted that the method of producing the server correspondence tableTR2 is not limited, but a manual or automatic (mechanical) method may beapplied.

(Acquisition of Master Communication Log)

The acquisition of the communication logs and the merging of thecommunication logs to be acquired will be described referring to FIG. 10and FIGS. 24 to 26.

FIG. 24 is a table illustrating a state where the communication logs ofthe first block A20 a are merged, and the IP addresses are appropriatelyconverted, as one example. As is described in FIG. 10, the communicationlog acquiring unit 41 acquires the communication log from the firstblock A20 a, and the communication log shaping unit 42 stores thecommunication log acquired by the communication log acquiring unit 41 inthe communication log table T21 a in FIG. 24. As is described in FIG.11, the communication log shaping unit 42 appropriately performs themerging processing at the time of storing the communication log.

For example, the communication log shaping unit 42 determines whetherthe communication log, in which IP addresses respectively correspond tothe IP addresses of the transmission source and the transmissiondestination in the communication log acquired by the communication logacquiring unit 41, has already been stored in the communication logtable T21 a in FIG. 24 (Step S2). When the communication log shapingunit 42 determines that the communication log, in which the IP addressesrespectively correspond to the IP addresses of the transmission sourceand the transmission destination in the communication log acquired bythe communication log acquiring unit 41, has not been stored in thecommunication log table T21 a in FIG. 24 (Step S2, NO), thecommunication log shaping unit 42 stores the communication log acquiredby the communication log acquiring unit 41 in the communication logtable T21 a in FIG. 24 (Step S3).

When the communication log shaping unit 42 determines that thecommunication log, in which the IP addresses respectively correspond tothe IP addresses of the transmission source and the transmissiondestination in the communication log acquired by the communication logacquiring unit 41, has already been stored in the communication logtable T21 a in FIG. 24 (Step S2, YES), the communication log shapingunit 42 determines whether the communication log, in which a port numbercorresponds to any of the port number of the transmission source and theport number of the transmission destination in the communication logacquired by the communication log acquiring unit 41, has already beenstored in the communication log table T21 a in FIG. 24 (Step S4). Whenthe communication log shaping unit 42 determines the communication log,in which the port number corresponds to any of the port number of thetransmission source and the port number of the transmission destinationin the communication log acquired by the communication log acquiringunit 41, has already been stored in the communication log table T21 a(Step S4, YES), the communication log shaping unit 42 merges the mergingsource communication log, which has already been stored in thecommunication log table T21 a in FIG. 24, with the communication logacquired by the communication log acquiring unit 41. In contrast, whenthe communication log shaping unit 42 determines the communication log,in which the port number corresponds to any of the port number of thetransmission source and the port number of the transmission destinationin the communication log acquired by the communication log acquiringunit 41, has not been stored in the communication log table T21 a inFIG. 24 (Step S4, NO), the process proceeds to the Step S3.

Further, after the completion of the merging the communication logs, thecommunication log comparing unit 43 converts the IP addresses stored inthe transmission-source IP address column and thetransmission-destination IP address column in the communication logtable T21 a in FIG. 24, into IP addresses corresponding to the seconddevice group targeted for the operational verification (for example, thefourth block D) based on the server correspondence table TR2 in FIG. 23.

Specifically, the communication log comparing unit 43 selects the IPaddress to be converted, from the IP addresses stored in thetransmission-source IP address column and the transmission-destinationIP address column in the communication log table T21 a in FIG. 24. Thecommunication log comparing unit 43 searches an IP address correspondingto the IP address to be selected, from the IP addresses stored in the IPaddress column (the first block A) of the server correspondence tableTR2 in FIG. 23.

Then, the communication log comparing unit 43 specifies an IP addressdisposed at the same line as that of the IP address to be searched, fromthe IP addresses stored in the IP address column (the fourth block D) ofthe server correspondence table TR2 in FIG. 23. Then, the communicationlog comparing unit 43 converts the IP address selected in thecommunication log table T21 a in FIG. 24 into the IP address to bespecified. When the IP address selected and the IP address specified areidentical, the communication log comparing unit 43 does not execute theaforementioned conversion.

For example, the communication log comparing unit 43 assumes that the IPaddress of the transmission source in the communication log illustratedby the reference number P11 in the communication log table T21 a in FIG.24 is “12. 0. 3. 6” prior to the conversion. In this case, thecommunication log comparing unit 43 converts the IP address “12. 0. 3.6” into the IP address “12. 12. 3. 6” based on the server correspondencetable TR2 in FIG. 23.

FIG. 25 is a table illustrating a state where the communication logs ofthe second block B20 b are merged, and the IP addresses areappropriately converted, as one example. As is described in FIG. 10, thecommunication log acquiring unit 41 acquires the communication log fromthe second block B20 b, and the communication log shaping unit 42 storesthe communication log acquired by the communication log acquiring unit41 in the communication log table T21 b in FIG. 25. As is described inFIG. 11, the communication log shaping unit 42 appropriately performsthe merging processing at the time of storing the communication log.

Further, after the completion of the merging the communication logs, thecommunication log comparing unit 43 converts the IP addresses stored inthe transmission-source IP address column and thetransmission-destination IP address column in the communication logtable T21 b in FIG. 25, into IP addresses corresponding to the seconddevice group targeted for the operational verification (for example, thefourth block D) based on the server correspondence table TR2 in FIG. 23.

The acquisition processing, the storage processing, the mergingprocessing of communication logs described above, and further theconversion processing of the IP addresses have been described in detailin FIG. 24. Accordingly, their descriptions are omitted.

FIG. 26 is a table illustrating a state where the communication logs ofthe third block C20 c are merged, and the IP addresses are appropriatelyconverted, as one example. As is described in FIG. 10, the communicationlog acquiring unit 41 acquires the communication log from the thirdblock C20 c, and the communication log shaping unit 42 stores thecommunication log acquired by the communication log acquiring unit 41 inthe communication log table T21 c in FIG. 26. As is described in FIG.11, the communication log shaping unit 42 appropriately performs themerging processing at the time of storing the communication log.

Further, after the completion of the merging the communication logs, thecommunication log comparing unit 43 converts the IP addresses stored inthe transmission-source IP address column and thetransmission-destination IP address column in the communication logtable T21 c in FIG. 26, into IP addresses corresponding to the seconddevice group targeted for the operational verification (for example, thefourth block D) based on the server correspondence table TR2 in FIG. 23.The acquisition processing, the storage processing, the mergingprocessing of communication logs described above, and further theconversion processing of the IP addresses have been described in detailin FIG. 24. Accordingly, their descriptions are omitted.

The reference number “To” in FIG. 5 illustrates a state where thecommunication log database DB1 in FIG. 5 stores the communication logtables T21 a, T21 b, and T21 c.

As is described above, the communication log comparing unit 43 convertsthe IP addresses of the transmission source and the transmissiondestination of the first communication log in the plurality of firstdevice groups into the IP addresses set in the devices of the seconddevice group, corresponding to the IP addresses of the transmissionsource and the transmission destination, based on the servercorrespondence table TR2 in FIG. 23.

(Generation of Master Communication Log Table)

FIG. 27 is a table illustrating a state where a master communication logis stored, as one example. A master communication log table T21 mincludes the transmission-source IP address column, thetransmission-source port number column, the transmission-destination IPaddress column, the transmission-destination port number column, a blocknumber column (hereinafter, referred to as “DC number”), and a certaintycolumn.

The master communication log table T21 m is a table that stores thecommunication log as a comparison source. The master communication logtable T21 m stores each communication log and the certainty of eachcommunication log. A reference number “Tm” in FIG. 5 illustrates a statewhere the communication log database DB1 in FIG. 5 stores the mastercommunication log table T21 m. Hereinafter, the generation of the mastercommunication log table T21 m will be described.

The communication log comparing unit 43 reproduces the communication logtables T21 a in FIG. 24 and generates the DC number column and thecertainty column on the right side of the transmission-destination portnumber column in the table to be reproduced. Herein, the communicationlog comparing unit 43 stores “1” in the DC number column correspondingto each communication log. The table including the DC number column andthe certainty column is a first master communication log table (notillustrated) that is currently being generated.

Subsequently, the communication log comparing unit 43 takes out theentire communication logs from the communication log table T21 b in FIG.25 and the communication log table T21 c in FIG. 26. The communicationlog comparing unit 43 stores the communication logs that correspond toeach other, from the entire communication logs, as one communication login the master communication log table T21 m. Further, the communicationlog comparing unit 43 stores the number of blocks, in which there existthe communication logs that correspond to each other, in the DC columnof the master communication log table T21 m corresponding to thecommunication logs that correspond to each other.

Herein, the communication logs that correspond to each other mean thecommunication logs in which the IP address of the transmission source,the IP address of the transmission destination, the port number of thetransmission source, and the port number of the transmission destinationare all mutually corresponded. Moreover, the communication logs thatcorrespond to each other are applied to communication logs in which thefollowing first and second requirements are satisfied. The firstrequirement is such that the IP address of the transmission source andthe IP address of the transmission destination are mutually correspondedin respective communication logs. The second requirement is such that,when the port numbers of the transmission source are merged, the portnumbers of the transmission destination are mutually corresponded inrespective communication logs, or such that, when the port numbers ofthe transmission destination are merged, the port numbers of thetransmission source are mutually corresponded in respectivecommunication logs.

Also, the communication log comparing unit 43 stores the communicationlogs, which do not correspond to each other in the entire communicationlogs, in the master communication log table T21 m. Further, thecommunication log comparing unit 43 stores “1” in the DC number columnof the master communication log table T21 m corresponding to thecommunication logs which do not correspond to each other.

For example, in the case of FIGS. 24 to 26, respective communicationlogs illustrated by the reference numbers “P1 a”, “P1 b”, and “P1 c”include the IP address “192. 168. 1. 26” of the transmission source, theport number “*****” of the transmission source, the IP address “192.168. 1. 37” of the transmission destination, and the port number “25” ofthe transmission destination. Accordingly, each communication logsatisfies the first and second requirements. Furthermore, as isillustrated by the reference number P1 m in FIG. 27, the communicationlog comparing unit 43 stores the aforementioned communication log in themaster communication log table T21 m in FIG. 27. Moreover, the blocks inwhich the aforementioned communication log exists are the three blocks(the number of blocks is three), which are the first block A20 a, thesecond block B20 b, and the third block C20 c. Accordingly, thecommunication log comparing unit 43 stores “3” in the DC number columnof the master communication log table T21 m corresponding to theaforementioned communication log.

Also, for example, in the case of FIGS. 24 and 25, respectivecommunication logs illustrated by reference numbers “P2 a” and “P2 b”include the IP address “192. 168. 1.37” of the transmission source, theport number “*****” of the transmission source, the IP address “192.168. 1. 31” of the transmission destination, and the port number “2952”of the transmission destination. Accordingly, each communication logsatisfies the first and second requirements. Furthermore, as isillustrated by the reference number P2 m in FIG. 27, the communicationlog comparing unit 43 stores the aforementioned communication log in themaster communication log table T21 m in FIG. 27. Moreover, the blocks inwhich the aforementioned communication log exists are the two blocks(the number of blocks is two), which are the first block A20 a and thesecond block B20 b. Accordingly, the communication log comparing unit 43stores “2” in the DC number column of the master communication log tableT21 m corresponding to the aforementioned communication log.

Also, for example, in the case of FIG. 26, the communication logillustrated by a reference number “P3 c” includes the IP address “192.168. 1. 37” of the transmission source, the port number “*****” of thetransmission source, the IP address “192. 168. 1. 31” of thetransmission destination, and the port number “2685” of the transmissiondestination. As is obvious in FIGS. 24 and 25, a communication log thatcorresponds to this communication log illustrated by the referencenumber “P3 c” is not stored in the communication log table T21 a and thecommunication log table T21 b. In other words, this communication logdoes not correspond to any communication log in the entire communicationlogs. Accordingly, as illustrated by a reference number “P3 m” in FIG.27, the communication log comparing unit 43 stores this communicationlog in the master communication log table T21 m in FIG. 27. Further, thecommunication log comparing unit 43 stores “1” in the DC number columnof the master communication log table T21 m corresponding to thiscommunication log.

According to the above-described storage processing executed by thecommunication log comparing unit 43, the communication logs are storedin the transmission-source IP address column, the transmission-sourceport number column, the transmission-destination IP address column, andthe transmission-destination port number column of the mastercommunication log table T21 m, and the numerical values are stored inthe DC number column.

When the storage processing of the aforementioned communication logs andnumerical values is completed, the communication log comparing unit 43carries out the calculation of the certainty. More specifically, thecommunication log comparing unit 43 stores a value that is obtained bythe numerical value divided by the number of entire blocks in which theoperational verification has already been completed, in the certaintycolumn corresponding to the numerical value stored in the DC numbercolumn of the master communication log table T21 m. The number of entireblocks in which the operational verification has already been completedis also the total number of first device groups in which the operationalverification has already been completed.

In the examples of FIGS. 24 to 26, the number of entire blocks in whichthe operational verification has already been completed is “3”.Accordingly, when the numerical value stored in the DC number column ofthe master communication log table T21 m is “3”, the communication logcomparing unit 43 stores “1” (3 (numerical value in the DC numbercolumn)/3 (the number of entire blocks in which the operationalverification has already been completed)) on the line of the certaintycolumn corresponding to the numerical value. Moreover, when thenumerical value stored in the DC number column of the mastercommunication log table T21 m is “2”, the communication log comparingunit 43 stores “2/3” (2 (numerical value in the DC number column)/3 (thenumber of entire blocks in which the operational verification hasalready been completed)) on the line of the certainty columncorresponding to the numerical value.

At the time point when the storage processing of the certainty describedin FIGS. 24 to 26 is completed, the correspondence presence column is ina state (blank) where nothing is stored.

(Operational Verification of Fourth Block D20 d)

When the storage processing of the certainty described in FIGS. 24 to 26is completed, as is described in the first embodiment, the administratorverifies whether the fourth block D20 d appropriately operates prior tothe operation of the fourth block D20 d. Each server of the fourth blockD20 d stores various communication logs in its own device based on theoperational verification. As is described in FIG. 10, the communicationlog acquiring unit 41 of the administration device 4 acquires thecommunication log from the fourth block D20 d. The communication logshaping unit 42 stores the communication log acquired by thecommunication log acquiring unit 41 in the communication log table. Asis described in FIG. 11, the communication log shaping unit 42appropriately performs the merging processing at the time of storing thecommunication log.

FIG. 28 a table illustrating a state where the communication logs of thefourth block D20 d are merged. A communication log table T21 d in FIG.28 includes the same columns as those of the communication log tabledescribed in FIG. 13. The communication log table T21 d, for example, asis illustrated by the reference number “P1 d”, stores the IP address“192. 168. 1. 26” in the transmission-source IP address column, the portnumber “*****” in the transmission-source port number column, the IPaddress “192. 168. 1. 37” in the transmission-destination IP addresscolumn, and the port number “25” in the transmission-destination portnumber column. Further, the communication log table T21 d, as isillustrated by the reference number “P1 d”, stores the state “OK” in thestate column. It is noted that the reference number Ts in FIG. 5illustrates a state where the communication log database DB1 in FIG. 5stores the communication log table T21 d.

Subsequently, the communication log comparing unit 43 executes thecomparison of the communication logs, and the error detecting unit 44executes the detection of the setting error associated withcommunications. At the time point prior to the detection of the settingerror, the correspondence presence column is in a state (blank) wherenothing is stored.

(Detection Processing of Setting Error)

FIG. 29 is a second flowchart to describe the entire flow of thecomparison processing of the communication logs and the detectionprocessing for setting errors. In FIG. 29, the processing at the StepsS21 to S23 is similar to that of the Steps S11 to S13 described in FIG.14.

Step S21: the communication log comparing unit 43 reads out the entirecommunication logs which serve as a master (reference) for thecomparison processing from the communication log database DB1.Specifically, the communication log comparing unit 43 reads out thespecific information (the IP addresses of the transmission source andthe transmission destination and the port numbers of the transmissionsource and the transmission destination) of the entire communicationlogs stored in the master communication log table T21 m in FIG. 27.

Step S22: the communication log comparing unit 43 reads out thecommunication log targeted for the operational verification, from thecommunication log database DB1. The communication log targeted for theoperational verification is the communication log of the fourth blockD20 d. Specifically, the communication log comparing unit 43 reads outthe specific information of the communication log, which has not beenread out yet, from the specific information of the communication logsstored in the communication log table T21 d in FIG. 28.

Step S23: the communication log comparing unit 43 compares thecommunication log targeted for the operational verification, which isread out at the Step S22, with each master communication log, and sets aflag, which indicates that both communication logs correspond to eachother, to both communication logs. The processing at the Step S23corresponds to the Step S13 in FIG. 14. The details of the Step 13 havebeen described in FIG. 15, and the description of the process at theStep S23 is omitted.

Step S24: the error detecting unit 44 detects the setting errorassociated with communications, and the notifying unit 45 notifies theadministrator of the setting error associated with communications, whichis detected by the error detecting unit 44 in accordance with thepriority. Regarding the aforementioned notification, the notifying unit45 preferentially notifies the administrator of the setting errorassociated with communications, with respect to the communication loghaving a high degree of certainty at the time of notifying the settingerror.

The communication log comparing unit 43 executes the processing at theStep S22 and Step S23 until the communication log comparing unit 43reads out all the communication logs from the communication log tableT21 d in FIG. 28 at the Step S22 (loops LP11 to LP12).

The processing of setting the flag (Step S23) will specifically bedescribed referring to FIGS. 27 and 28. For example, as is described inFIG. 16, the communication log illustrated by the reference number “P1m” in FIG. 27 corresponds to the communication log illustrated by thereference number “P1 d” in FIG. 28. Accordingly, the communication logcomparing unit 43 stores “presence” of the flag in the correspondencepresence column of the communication log.

In contrast, regarding the communication log illustrated by thereference number P2 m, a communication log, in which its IP addressesrespectively correspond to the IP address (“192. 168. 1. 37”) of thetransmission source and the IP address (“192. 168. 1. 31”) of thetransmission destination included in the communication log illustratedby the reference number “P2 m”, and its port number corresponds to theport number (“2952”) of the transmission destination included in thecommunication log illustrated by the reference number “P2 m”, has notbeen stored in the communication log table T21 d in FIG. 28.Accordingly, the communication log comparing unit 43 does not store“presence” (blank) of the flag in the correspondence presence column ofthe communication log.

When the aforementioned processing of setting the flag is completed, theerror detecting unit 44 proceeds to the detection processing (see thefirst to third processing) of the setting error described in the firstembodiment.

Specifically, the error detecting unit 44 detects the communication login which IP addresses do not correspond to the IP addresses of thetransmission source and the transmission destination included in theplurality of second communication logs, from the plurality of firstcommunication logs, as the communication log having the setting error.Similarly, the error detecting unit 44 detects the communication log inwhich the IP addresses respectively correspond to the IP addresses ofthe transmission source and the transmission destination included in theplurality of second communication logs, but port numbers do notcorrespond to the port numbers of the transmission source and thetransmission destination included in the plurality of secondcommunication logs, from the plurality of first communication logs, asthe communication log having the setting error. Further, the errordetecting unit 44 detects the communication log in which the IPaddresses do not correspond to the IP addresses of the transmissionsource and the transmission destination included in the plurality offirst communication logs, from the plurality of second communicationlogs, as the communication log having the setting error. Similarly, theerror detecting unit 44 detects the communication log in which the IPaddresses respectively correspond to the IP addresses of thetransmission source and the transmission destination included in theplurality of first communication logs, but port numbers do notcorrespond to the port numbers of the transmission source and thetransmission destination included in the plurality of firstcommunication logs, from the plurality of second communication logs, asthe communication log having the setting error.

It is noted that the first communication logs, for example, are thecommunication logs regarding the network communication in the firstdevice groups (the first block A20 a to the third block C20 c) in whichthe operational verification has already been completed. The secondcommunication logs, for example, are the communication logs regardingthe network communication in the second device groups (the fourth blockD20 d) targeted for the operational verification.

The error detecting unit 44 detects the setting error in the specificinformation associated with the communication log having the settingerror, in the devices of the second device group.

Hereinafter, the detection processing and the notification processingfor the setting error will be described. In the second embodiment, onlythe second detection processing described in the first embodiment willbe described. In the examples of FIGS. 27 to 28, the error detectingunit 44 executes the processing (second detection processing) ofdetecting the presence or absence of communication executed only in thefirst device groups (the first block A20 a to the third block C20 c) inwhich the operational verification has already been completed. In otherwords, the error detecting unit 44 detects the communication log thatexists only in the first device groups in which the operationalverification has already been completed, as the communication log havingthe setting error.

Based on the second detection processing, the error detecting unit 44detects a plurality of communication logs illustrated by the referencenumbers P2 m and P4 m in FIG. 27, as the communication log that existsonly in the first device groups in which the operational verificationhas already been completed.

As is described in the first embodiment, the notifying unit 45 informsthe administrator that there occurs the setting error associated withthe communication logs illustrated by the reference numbers “P2 m” and“P4 m” in FIG. 27. Specifically, when the error detecting unit 44detects the communication logs having the plurality of the settingerrors, the notifying unit 45 sequentially informs the administratorthat there occur the setting errors in the specific informationassociated with the communication logs (see the reference numbers P2 mand P4 m) having the setting errors, for every communication log havingthe setting errors. The specific example regarding the content of thenotification has been described in the first embodiment, and itsdescription is omitted.

Thus, when there occur the plurality of the setting errors, it ispreferable that the setting errors associated with the communication loghaving a high degree of importance, that is, a high degree of certaintybe preferentially informed to the administrator. To be more specific,the certainty stored corresponding to the communication log of the firstdevice group in which the operational verification has already beencompleted indicates the emergence frequency of the communication logwith respect to the entire blocks in which the operational verificationhas already been completed. When the setting error is detected based onthe results of comparison between the communication log having a highdegree of emergence frequency, in other words, the communication loghaving a high degree of certainty (master communication log) and thecommunication log targeted for the operational verification, it isdetermined that it is requisite to rapidly correct the setting error.Then, the administration device 4 preferentially notifies theadministrator of the setting error associated with the communication loghaving the high degree of certainty.

Accordingly, when the notifying unit 45 sequentially informs theadministrator that there occurs the setting error, for everycommunication log having the setting error, the notifying unit 45changes the orders of sequential notification based on the certainty ofthe first communication logs respectively corresponding to thecommunication logs having the setting error. In the examples of FIGS. 27to 28, the first communication logs, respectively corresponding to thecommunication logs having the setting errors, are exemplified bycommunication logs illustrated by the reference numbers “P2 m” and “P4m” in FIG. 27.

For example, the certainty of the communication log illustrated by thereference number “P2 m” is “2/3”, and the certainty of the communicationlog illustrated by the reference number “P4 m” is “1”. That is, thecertainty of the communication log illustrated by the reference number“P4 m” is higher than the certainty of the communication log illustratedby the reference number “P2 m”. Accordingly, after the notifying unit 45informs the administrator that there occurs the setting error associatedwith the communication log illustrated by the reference number “P4 m”,the notifying unit 45 informs the administrator that there occurs thesetting error associated with the communication log illustrated by thereference number “P2 m”.

According to the administration device of the second embodiment, when amagnitude of setting errors are detected, it is possible that thesetting error is informed to the administrator in accordance with thepriority. Accordingly, it is not requisite for the administrator todetermine the correction order of the setting errors by himself, so thatthe setting errors can be corrected in accordance with the priorityinformed by the administration device.

[Third Embodiment of Administration Device]

In the administration device of the third embodiment, the number oftimes of communication (also referred to as “the number of times to beused”) that indicates the number of times of execution of communicationassociated with the first communication log is reflected on thecertainty of the first communication log described in the secondembodiment. The meaning of the number of times of communication will bedescribed later. The description of the third embodiment is based on thepresumption that the hardware block diagram in FIG. 22 and the servercorrespondence table TR2 in FIG. 23 described in the second embodimentare provided.

First, the number of times of communication will be described based onFIG. 4. The communication software 2022 of the server SVR in FIG. 4generates communication packets in which the IP address of thetransmission source is “x1. y1. z1. w1”, and the port number of thetransmission source is “p1”, and the IP address of the transmissiondestination is “x2 . y2 . z2. w2”, and the port number of thetransmission destination is “p2”. Then, the communication software 2022transmits the communication packets to other server in which the IPaddress “x2. y2. z2. w2” of the transmission destination is set. Thecommunication software 2022 counts the number of times of transmissionof the communication packets as the number of times of communication andstores the number of times in the communication log. For example, whenthe communication software 2022 transmits one hundred of communicationpackets, the communication software 2022 counts the number of times ofcommunication as one hundred. When reply packets are transmitted fromother servers to the SVR server, the number of reply packets may beincluded in the number of times of communication.

Furthermore, for example, the number of times of sessions establishedbetween the communication software 2022 of the SVR server and thecommunication software of other server may be provided as the number oftimes of communication. For example, when the sessions are establishedten times between the communication software 2022 of the SVR server andthe communication software of other server, the ten times serves as thenumber of times of communication.

As is described in the second embodiment, the administration device 4acquires the communication logs and executes the merging of thecommunication logs to be acquired. When Cn sets (Cn is an integer of twoor more) of communication logs are merged into one communication log,the communication log shaping unit 42 of the administration device 4counts the sum of the number of times of communication of Cn sets ofcommunication logs, as the number of times of communication of onemerged communication log.

FIG. 30 is a table illustrating a state where the communication logs ofthe first block A20 a are merged, and the IP addresses are appropriatelyconverted, as another example. A communication log table T31 a in FIG.30 is a table in which a communication number-of-times column is addedto the communication log table T21 a in FIG. 24.

As is described in FIG. 10, the communication log acquiring unit 41acquires the communication log from the first block A20 a.

Herein, it is assumed that the communication software (not illustrated)of the server of the first block A20 a generates a first communicationlog that includes the IP address “192. 168. 1. 26” of the transmissionsource, the port number “58394” of the transmission source, the IPaddress “192. 168. 1. 37” of the transmission destination, the portnumber “25” of the transmission destination, and the number of times“eight times” of communication. Further, it is assumed that thecommunication software (not illustrated) of the server of the firstblock A20 a generates a second communication log that includes the IPaddress “192. 168. 1. 26” of the transmission source, the port number“58413” of the transmission source, the IP address “192. 168. 1. 37” ofthe transmission destination, the port number “25” of the transmissiondestination, and the number “four times” of times of communication.

As is described in FIGS. 11 and 24, the communication log shaping unit42 merges the first communication log with the second communication logand stores the merged communication log in the communication log tableT31 a in FIG. 30, as illustrated by the reference number P1 a. In theaforementioned storage, the communication log shaping unit 42 stores thecommunication log in the communication log table T31 a in FIG. 30, asillustrated by the reference number P1 a, in such a manner that 12(=8+4) is stored in the communication number-of-times column of thecommunication log table T31 a.

Further, after the completion of the merging the communication logs, thecommunication log comparing unit 43 converts the IP addresses stored inthe transmission-source IP address column and thetransmission-destination IP address column in the communication logtable T21 a in FIG. 24, into IP addresses corresponding to the seconddevice group targeted for the operational verification (for example, thefourth block D) based on the server correspondence table TR2 in FIG. 23.The detail of the conversion has been described in FIG. 24, andtherefore, and its description is omitted.

FIG. 31 is a table illustrating a state where the communication logs ofthe second block B20 b are merged, and the IP addresses areappropriately converted, as another example. As is described in FIG. 10,the communication log acquiring unit 41 acquires the communication logsfrom the second block B20 b. Then, the communication log shaping unit 42performs the storage processing and the merging processing of thecommunication logs to be acquired and the conversion processing of theIP addresses, and for example, generates the communication log table T31b in FIG. 31.

FIG. 32 is a table illustrating a state where the communication logs ofthe third block C20 c are merged, and the IP addresses are appropriatelyconverted, as another example. As is described in FIG. 10, thecommunication log acquiring unit 41 acquires the communication logs fromthe third block C20 c. Then, the communication log shaping unit 42performs the storage processing and the merging processing of thecommunication logs to be acquired and the conversion processing of theIP addresses, and for example, generates the communication log table T31c in FIG. 32.

At the time point when the storage processing of the number of times tobe used, which described in FIGS. 30 to 32, is completed, thecorrespondence presence column is in a state (blank) where nothing isstored. The reference number “To” in FIG. 5 illustrates a state wherethe communication log database DB1 in FIG. 5 stores the communicationlog tables T31 a, T31 b, and T31 c.

(Generation of Master Communication Log Table)

FIG. 33 is a table illustrating a state where a master communication logis stored, as one example. A master communication log table T31 m is atable in which the communication number-of-times column is added to themaster communication log table T21 m in FIG. 27.

Herein, according to the processing described in FIG. 27, thecommunication log comparing unit 43 stores data in respective columnsexcept the communication number-of-times column and the correspondencepresence column of the master communication log table T31 m in FIG. 33.Herein, when there are a plurality of communication logs that correspondto each other, as described in FIG. 27, in the communication logs of thefirst block A20 a to the third block C20 c, the communication logcomparing unit 43 calculates the sum of the number of times ofcommunication of the plurality of communication logs that correspond toeach other. Then, as is described in FIG. 27, the communication logcomparing unit 43 merges the communication logs that correspond to eachother and stores the merged communication logs in the mastercommunication log table T31 m in FIG. 33. In the aforementioned storage,the communication log comparing unit 43 stores the sum to be calculatedin the communication number-of-times column of the master communicationlog table T31 m.

When there are communication logs that do not correspond to each other,as described in FIG. 27, in the communication logs of the first blockA20 a to the third block C20 c, the communication log comparing unit 43stores the number of times of communication of the communication log inthe communication number-of-times column of the master communication logtable T31 m at the time of storing the communication logs in the mastercommunication log table T31 m in FIG. 33.

Lastly, in the master communication log table T31 m in FIG. 33, thecommunication log comparing unit 43 multiplies the certainty stored inthe certainty column by the number of times of communication in thecommunication number-of-times column stored on the same line as that ofthe certainty, and updates the multiplied value on the certainty storedin the certainty column. A numerical value in parentheses in thecertainty column of the master communication log table T31 m in FIG. 33represents a numerical value prior to the updating.

For example, in the cases of FIGS. 30 to 32, respective communicationlogs illustrated by the reference numbers “P1 a”, “P1 b”, and “P1 c”include the IP address “192. 168. 1. 26” of the transmission source, theport number “*****” of the transmission source, the IP address “192.168. 1. 37” of the transmission destination, and the port number of “25”of the transmission destination. Accordingly, respective communicationlogs satisfy the first and second requirements (see the descriptionregarding FIG. 27). Therefore, as is illustrated by the reference numberP1 m in FIG. 33, the communication log comparing unit 43 stores theaforementioned communication logs in the master communication log tableT31 m in FIG. 33. Furthermore, the blocks, in which the aforementionedcommunication logs exist, are three blocks (the number of blocks isthree) such as the first block A20 a, the second block B20 b, and thethird block C20 c. Accordingly, the communication log comparing unit 43stores “3” in the DC number column of the master communication log tableT21 m corresponding to the aforementioned communication log. Then, thecommunication log comparing unit 43 stores “1” (3 (numerical value inthe DC number column)/3 (the number of entire blocks in which theoperational verification has already been completed)) in the certaintycolumn of the master communication log table T21 m. Further, the numbersof times of communication in the aforementioned communication logs arerespectively “12”, “15”, and “11”, so that the communication logcomparing unit 43 stores “38”, which is the sum of the numbers of timesof communication, in the communication number-of-times column of themaster communication log table T21 m corresponding to the aforementionedcommunication log.

Then, the communication log comparing unit 43 multiplies the certainty“1” by the number of times of communication “38” and rewrites themultiplied value “38” corresponding to the certainty “1”. At the timepoint when the rewriting processing of the certainty described in FIG.33 is completed, the correspondence presence column is in a state(blank) where nothing is stored.

(Operational Verification of Fourth Block D20 d)

When the storage processing of the certainty described in FIGS. 30 to 32is completed, as is described in the first and second embodiments, theadministrator verifies whether the fourth block D20 d appropriatelyoperates prior to the management of the fourth block D20 d. Each serverof the fourth block D20 d stores various communication logs in its owndevice based on the operational verification. As is described in FIG.10, the communication log acquiring unit 41 of the administration device4 acquires the communication log from the fourth block D20 d. Thecommunication log shaping unit 42 stores the communication log acquiredby the communication log acquiring unit 41 in the communication logtable. As is described in FIG. 11, the communication log shaping unit 42appropriately performs the merging processing at the time of storing thecommunication log. As a result, the communication log shaping unit 42generates the communication log table T21 d described in FIG. 28.

Subsequently, the communication log comparing unit 43 executes thecomparison of the communication logs, and the error detecting unit 44executes the detection of the setting error associated withcommunications. The detail of the detection processing has beendescribed in the second embodiment, and accordingly, its description isomitted.

According to the administration device of the embodiments, the number oftimes of communication of the communication log is reflected on thecertainty of the communication log. As a result, it is possible todetermine the priority correctly.

[Fourth Embodiment of Administration Device]

The administration device in the embodiment performs clustering of thecommunication log of the setting error candidate and displays theclustered communication log to the administrator in order that theadministrator efficiently performs investigation of the setting errorfactor. The detail will be described as below. When building additionallarge data center, there is a case that same application program andmiddleware are set to a plurality of devices (for example, a server anda switch).

In order to make a setting efficiency with a high, there is a case thatthe administrator creates script file for setting and performs thecreated script file for setting to install the application program andmiddleware to the plurality of devices in one lump. Also, in order tomake a setting efficiency with a high, there is a case that theadministrator installs the application program and middleware to theplurality of devices in one lump by referring to a setting manual whichwas created in advance.

Here, it is assumed that there is an error description in a part of thescript file or the manual for setting. When the administrator performsthe script file for setting which has error description or installs theapplication program and middleware to the plurality of devices byreferring to the setting manual which has error description, there is acase that the setting error of the communication relating information isoccurred to the plurality of devices due to same factor.

For example, there is a script file (as described by script file X asbelow) which sets an application program (below, as described byapplication X) that utilize the port number “161” to twenty number ofdevices. Here, it is assumed that setting command, which sets theapplication X to four number of devices that have been set the IPaddresses “12. 0. 0. 3”, “12. 0. 0. 6”, “12. 1. 2. 11” and “12. 1. 2.12” respectively, is omitted in the script file X, due to thedescription error, for example.

In this case, when the administrator executes the script file X to thedevices of the second device group (for example, the second block B20 bin FIG. 2), it is not executed to set the application X to theaforementioned four number of devices.

In this case, two status is considered as below. The first state is thatthe corresponding four devices to the above four devices in the firstdevice group (for example, the first block A20 a in FIG. 2) which hasalready verified the operation is appropriately set and execute theapplication X. The second state is that the four devices in the secondblock B20 b do not execute the application X because the four deviceshave not been set the application X.

When two status are established and the operation verification asexplained by the first embodiment is performed and when the four devicesin the first block A20 a in FIG. 2 performs communication to the otherdevices, the communication logs are recorded into the four devices inthe first block A20 a. Note that the other devices is devices in whichthe IP address “12. 0. 3. 7” is set, for example.

Accordingly, as described in the first embodiment, these communicationlogs are informed to the administrator as the setting error candidate.

The administrator looks at these communication logs, finds the settingerror factor of the communication relating information of each of thefour devices and corrects the error factor. In this case, when theadministration device 4 integrates the setting errors of thecommunication relating information due to same factor into one anddisplays the integrated setting error, it is possible that theadministrator finds the setting error factor which is integrated aboutfour devices and efficiently performs the investigation of the settingerror factor. Below, the administration device will be explained.

(Block Diagram of Hardware and Software Module in Administration Device)

FIG. 34 is a hardware block diagram to explain an administration deviceof the fourth embodiment. In the administration device 4 in FIG. 34,same elements as that described in FIG. 1 are same reference number andtables Te, Tf, Tn are added to the storage device 403 in theadministration device 4 illustrated in FIG. 1. FIG. 35 is a blockdiagram of a software module of the administration device in FIG. 34 asanother example. As described in the first embodiment, the errordetecting unit 44 refers to the comparison result of the communicationlog and outputs the communication log of the setting error candidate toa clustering unit 46.

The clustering unit 46 sorts (referred to as clustering) the detectedsetting error candidates according to the similarity of the specifyinformation included in the communication log of the setting errorcandidates (also referred to communication log of a setting error) ofwhich the error detecting unit 44 detects. In other words, in the fourthembodiment, the specify information is information that can specify hecommunication content. For example, the information that can identifythe communication content is information such as a port number, a numberof communication, and amount of communication data. Below, the portnumber is exampled as the information that can specify the communicationcontents. When using the port number, it is possible to specify thecommunication content from the port number; because the port numbercorresponds to service such as applications and middleware which use theport number.

In other words, the clustering unit 46 aggregates the communication logof the setting error candidates having a common feature of thecommunication content. It is preferred that the information forspecifying the communication content is information which do not requirecomplex processing to obtain.

The clustering unit 46 shapes the communication log of the setting errorcandidate entered from the error detecting unit 44 as a preliminary stepfor performing clustering. The communication log of the setting errorcandidate includes at least of the IP address of the transmissionsource, the port number of the transmission source, and the IP addressof the transmission destination.

Below, One server among the servers, which are set the IP address of thetransmission source or the IP address of the transmission destinationincluded in the communication log of the setting error candidate, isreferred to as a target server, For example, the target server is aserver that is set the IP address “12.0.3.7”.

(Communication Log of Setting Error Candidates)

FIG. 36 is a table illustrating a communication log of the setting errorcandidates including the IP address of the target server.

The setting error candidate table Te11 in FIG. 36 is a tableillustrating the communication log of the setting error candidateincluding the IP address “12.0.3.7” of the target server. For example,the communication log of the setting error candidate stored in thesetting error candidate table Te11 is a communication log that existsonly in the first block A20 a which is described in the first embodimentof the administration device.

The setting errors candidate table Te11 has the IP address of thetransmission source field, the port number of the transmission sourcefield, the IP address of the transmission destination field, and theport number of the transmission destination field. The IP address of thetransmission source field is stored the IP address of the transmissionsource included in the communication log of the setting error candidate.The port number of the transmission source field is stored the portnumber of the transmission source included in the communication log ofthe setting error candidate. The IP address of the transmissiondestination field is stored the IP address of the transmissiondestination included in the communication log of the setting errorcandidate. The port number of the transmission destination field isstored the port number of the transmission destination included in thecommunication log of the setting error candidate.

The setting error candidate table Te11 stores the IP address of thetransmission source, the port number of the transmission source, the IPaddress of the transmission destination and the port number of thetransmission destination included in one communication log of thesetting error candidate, in one line.

For example, the communication log of the setting error candidatedepicted by a reference number “P31” is a communication log includingthe IP address “12.0.3.7” of the transmission source, the port number oftransmission source “*****”, the IP address of the transmissiondestination “12.0.0.3” and the port number of the transmissiondestination “161”. The number “*****” schematically depicts a state thatthe port number is merged, as described in FIG. 11.

The reference “Te” in FIG. 34 depicts a state that the communication logdatabase DB1 in FIG. 34 stores the setting error candidate table Te1.

FIG. 37 is a an example of a diagram for explaining the terminology usedin describing the clustering mentioned above. Below, a server of thecommunication partner of the target server is depicted by as a partnerserver.

FIG. 37 illustrates a state where the target server SVRt and the partnerserver SVRp send and receive communication packets each other. The IPaddress “12.0.3.7” is set in the target server SVRt.

A first case is that the partner server SVRp received the communicationpacket which was sent from the target server SVRt (referring to an arrowof “receive” from left to right in the drawing), In the first case, theport number used when the target server SVRt sent the communication logis called to as received port number of the transmission source. And theport number used when the partner server SVRp received the communicationlog is called to as received port number of the transmissiondestination.

In addition, a second case is that the partner server SVRp sent thecommunication packet to target server SVRt and the target server SVRtreceived the communication packet (referring to an arrow of “transmit”from right to left in the drawing). In the second case, the port numberused when the partner server SVRp sent the communication log is calledto as transmitted port number of the transmission source. And the portnumber used when the target server SVRt received the communication logis called as transmitted port number of the transmission destination.

(Shaping of Communication Log of Setting Error Candidates)

When communication with the target server SVRt and the partner serverSVRp is performed, the setting error candidate table Tel1 in FIG. 36 hasthe communication logs of a first type and a second type as below. Thefirst type communication log is a communication log which is stored whenthe partner server VRp sends a communication packet to the target serverSVRt. Second type communication log is a communication log stored whenthe target server SVRt sends a communication packet to the partnerserver SVRp. That is, the communication log in the communication betweenthe target server SVRt and the partner server SVRp are stored in thesetting error candidate table Te11 in FIG. 36 in the double.

For example, the IP address “12.0.3.7” is set to the target server SVRt,and the IP address “12.0.0.3” is set to the partner server SVRp. In thiscase, the target server SVRt and the partner server SVRp are devices(servers) in the first device group which has been verified theoperation (for example, the first block A20 a in FIG. 2). Then, thecommunication between the target server SVRt and the partner server SVRpis performed and the communication is success.

Further, in the devices of the second device group which is a target ofoperation verification (for example, the second block B20 b in FIG. 2),the communication between the servers with the same function as thetarget server SVRt and the partner server SVRp has not been performed,because of the setting error in the communication-related information.

When the communication between the partner server SVRp and the targetserver SVRt in the first block A20 a is successful, the communicationlogs “P31” and “P35” are stored in the setting error candidate tableTe11.

The communication log “P31” is stored when the target server SVRt sent acommunication packet to the partner server SVRp. The communication log“P35” is stored when the partner server SVRp sent the communicationpacket to the target server SVRt.

In addition, the communication log “P35” includes the IP address oftransmission source “12.0.0.3”, the port number of transmission source“161”, the IP address of transmission destination “12.0.3.7”, and theport number of transmission destination “*****”.

Next, the IP address “12.0.3.7” is set to the target server SVRt, andthe IP address “12.0.0.5” is set to the partner server SVRp. In thiscase, the target server SVRt and the partner server SVRp are servers inthe first block A20 a in FIG. 2.

In this case, when a communication from the partner server SVRp to thetarget server SVRt was successful, but a communication from the targetserver SVRt to the partner server SVRp was not successful, onlycommunication log “P32” is stored in the setting error candidate tableTe11. here, in the second block B20 b in FIG. 2, the communicationbetween the servers with the same function as the target server SVRt andthe partner server SVRp has not been performed, because of the settingerror in the communication-related information.

Below, in the server-to-server communication, a case that thecommunication from the first server to the second server was successful,but the communication from the second server to the first server was notsuccessful, is referred to as appropriate success of only one sidecommunication.

For example, the clustering unit 46, which clusters communication logsof the setting error candidates according to the similarity of the portnumber, performs the following process as a front step of performing theclustering.

The clustering unit 46 extracts the communication logs stored, byperforming a communication with target server SVRt and the partnerserver SVRp, from among the communication logs of the setting errorcandidates which were detected by the error detecting unit 44 andintegrates the extracted communication logs for each IP address that isset in the partner server SVRp, based on the target server SVRt.

Specifically, the clustering unit 46 gathers the communication logs ofthe setting error candidate, which are stored in the double, in a singlecommunication log. Further, the clustering unit 46 stores the one sidecommunication for the success of only one side communication. Below,cases to gather the communication logs of the setting error candidate,which are stored in the double, in a single communication log, and tostore the one side communication, is referred to as appropriate shapingof communication log.

FIG. 38, FIG. 39A and FIG. 39B are first and second flow diagramsillustrating the shaping process in which the clustering unit 46performs. FIG. 40 is a diagram illustrating an example of a table forstoring the communication log of the setting error candidates which wereshaped, That is, FIG. 40 illustrates a state that the communication logafter gathering the communication log that was extracted for each IPaddress that are set to the partner server SVRp is stored in a tableformat.

The shaping log table Tf1 in FIG. 40 includes the IP address of thepartner field, the transmitted port number of transmission source field,the transmitted port number of transmission destination field, thereceived port number of transmission source field, and the received portnumber of transmission destination field.

The partner IP address field is stored the IP address which is set tothe partner server SVRp (referring to FIG. 37) which is a communicationpartner for the target server SVRt (referring to FIG. 37). Thetransmitted port number of the transmission source field is stored theport number of the transmission source of the partner server SVRp whentransmitting. The transmitted port number of the transmissiondestination field is stored the port number of the transmissiondestination of the partner server SVRt when transmitting. The receivedport number of the transmission source field is stored the port numberof the transmission source of the partner server SVRp when receiving.The received port number of the transmission destination field is storedthe port number of the transmission destination of the partner serverSVRt when receiving.

The shaping process that the clustering unit 46 performs will beexplained with reference to FIG. 38 to FIG. 40. In addition, at the timeof starting the step S31 in FIG. 38, the fields in the shaping log tableTf1 in FIG. 40, the IP address and the port number is not stored.

Step S31 in FIG. 38: The clustering section 46 selects the IP addresswhich has not been selected from the communication logs of the settingerror candidates which were output from the error detecting section 44.The clustering unit 46 stores the communication log of the setting errorcandidate including selected IP address from the communication logs ofthe setting error candidates which were output from the error detectingsection 44, into the storage device 403 (referring to FIG. 5). Forexample, in the case of the IP address “12.0.3.7” which has been notselected, the clustering unit 46 stores the communication log of thesetting error candidate including the IP address “12.0.3.7” into thestorage unit 403. A table that stores the communication log of thesetting error candidate including the IP address “12.0.3.7” illustratesa setting error candidate table Te11 in FIG. 36, for example.

Step S32: The clustering unit 46 picks up one communication log of thesetting error candidate from the setting error candidate table Te11 inFIG. 36, and then stores it in the memory 402. Below, the communicationlog of the setting error candidate which was picked up in step S32 isreferred to as appropriate target communication log.

Every time the clustering unit 46 executes the Step S32, for example,the clustering section 46 picks up one of the communication log of thesetting error candidate toward the bottom of field from thecommunication log P31 of the setting error candidate which was stored inthe uppermost in the setting error candidate table Te11, and stores itinto the memory 402.

Step S33: The clustering unit 46 determines whether the IP address ofthe transmission source included in the target communication log matcheswith the IP address selected in the step S31. When a match is determinedin the step S33 (step S33/YES), the process proceeds to the step S34.

Step S34: the clustering section 46 determines whether the IP address oftransmission destination that is included in the target communicationlog is stored in the partner IP address field in the shaping log tableTf1 of FIG. 40. When the IP address is not stored in the Step S34 (stepS34/NO), the process proceeds to the step S35.

Step S35 the clustering section 46 stores the IP address of transmissiondestination that is included in the target communication log into thepartner IP address field in the shaping log table Tf1 of FIG. 40.

Here, when the IP address is stored in step S34 (step S34/YES), or whenthe process in Step S35 completes, the process proceeds to step S36.

Step S36: the clustering section 46 stores the port number oftransmission destination that is included in the target communicationlog into the received port number of the transmission destination fieldin the shaping log table Tf1. More specifically, when it is determinedYES in step S34, the clustering section 46 stores the port number oftransmission destination, that is included in the target communicationlog, into a cell of which column of the received port number oftransmission destination intersects to row of the cell stored the IPaddress of transmission destination included in the target communicationlog in the shaping log table Tf1. In addition, when the cell has beenalready stored the port number (including “*****”), the clustering unit46 stores the “*****” in place of the port number.

On the other hand, when the clustering section 46 executes the step S35,the clustering section 46 stores the port number of transmissiondestination that is included in the target communication log, into acell of which column of the received port number of transmissiondestination intersects to row of the cell stored the IP address oftransmission destination in the step S35 in the shaping log table Tf1.

Step S37: the clustering section 46 stores the port number oftransmission source, that is included in the target communication log,into, the received port number of transmission source in the shaping logtable Tf1. More specifically, when it is determined YES in step S34, theclustering section 46 stores the port number of transmission source,that is included in the target communication log, into a cell of whichcolumn of the received port number of transmission source intersects torow of the cell stored the IP address of transmission source included inthe target communication log in the shaping log table Tf1. In addition,when the cell has been already stored the port number (including“*****”), the clustering unit 46 stores the “*****” in place of the portnumber.

On the other hand, when the clustering unit 46 executes the step S35,the clustering unit 46 stores the port number of transmission sourcethat is included in the target communication log, into a cell of whichcolumn of the received port number of transmission source intersects torow of the cell stored the IP address of transmission destination in thestep S35 in the shaping log table Tf1.

In step S33, when it is determined that the IP address of thetransmission source included in the target communication log does notmatch with the selected IP address at step S31 (step S33/NO), theprocess proceeds to Step S38 in FIG. 39A.

Step S38 in FIG. 39: The clustering unit 46 determines whether the IPaddress of transmission source, that is included in the targetcommunication log, is stored in address column of the partner IP addressof the shaping log table Tf1 in FIG. 40. When it is determined that theIP address of transmission source is not stored in FIG. 38 (stepS38/NO), the process proceeds to step S39.

Step S39: the clustering unit 46 stores the IP address of transmissionsource that is included in the target communication log into the addresscolumn of the partner IP address of the shaping log table Tf1 in FIG.40.

Step S40: the clustering unit 46 stores the port number of transmissionsource that is included in the target communication log into thetransmitted port number of transmission source column the shaping logtable Tf1 in FIG. 40. More specifically, in case that it is determinedYES in step S38, the clustering unit 46 stores the port number oftransmission source that is included in the target communication log,into a cell of which column of the transmitted port number oftransmission source intersects to row of the cell stored the IP addressof transmission destination in the step S35 in the shaping log tableTf1. In addition, when the cell has been already stored the port number(including “*****”), the clustering unit 46 stores the “*****” in placeof the port number.

On the other hand, when the clustering unit 46 executes the step S39,the clustering unit 46 stores the port number of transmission sourcethat is included in the target communication log, into a cell of whichcolumn of the received port number of transmission source intersects torow of the cell stored the IP address of transmission destination in thestep S39 in the shaping log table Tf1.

Step S41: the clustering unit 46 stores the port number of transmissiondestination that is included in the target communication log into thecolumn of the transmitted port number of the transmission destination inthe shaping log table Tf1 in FIG. 40. More specifically, in case that itis determined YES in step S38, the clustering unit 46 stores the portnumber of transmission destination that is included in the targetcommunication log, into a cell of which column of the transmitted portnumber of transmission destination intersects to row of the cell storedthe IP address of transmission source in the step S35 in the shaping logtable Tf1. In addition, when the cell has been already stored the portnumber (including “*****”), the clustering unit 46 stores the “*****” inplace of the port number.

On the other hand, when the clustering unit 46 executes the step S39,the clustering unit 46 stores the port number of transmissiondestination that is included in the target communication log, into acell of which column of the transmitted port number of transmissiondestination intersects to row of the cell stored the IP address oftransmission source in the step S39 in the shaping log table Tf1.

The processes of Step S37 in FIG. 38 and Step S41 in FIG. 39 for allcommunication log of setting error candidates is not completed (notcomplete in loop LP 42), the process of loop S42 moves to the process ofloop S41, and the clustering unit 46 again executes the step S32 and itsfollowing step.

When the clustering unit 46 runs repeatedly the step S32 below andcompletes the execution of the process in step 33 below for thecommunication log of the setting error candidate including the IPaddress which were selected in step S31 (completion of loop LP42), theprocess proceeds to step S42. More detailed, the clustering unit 46picks up all communication log of the setting error candidate among aplurality of communication log of the setting error candidate stored inthe setting error candidate table Te11 and completes the execution theprocesses of step S33 and its following step, the process proceeds tostep S42.

Step S42: the clustering unit 46 stores “-” (hyphen) in cells which arenot the port number in the shaping log table Tf1 of FIG. 40. The storageof this hyphen means the storage indicating that only one sidecommunicating by the clustering unit 46 is successful.

When the clustering unit 46 runs repeatedly the step S31 below and doesnot complete the selection of all IP address included in thecommunication log of the setting error candidate which were output bythe error detecting unit 44 (incompletion of loop LP32), the processmoves from the loop LP 32 to loop LP 31. The clustering unit 46 againrepeatedly executes the step S31 and its following step.

On the other hand, the clustering unit 46 completes the selection of allIP address included in the communication log of the setting errorcandidate which were output by the error detecting unit 44 (completionof loop LP32), the process is finished.

(Examples of the Shaping of Communication Log of Setting ErrorCandidates)

The example of shaping of the communication log of setting errorcandidates will be described with reference to FIG. 36 through FIG. 40.Any data has not been stored in the table illustrated in FIG. 36 beforerunning the step S31.

The clustering unit 46 executes the step S31, and selects the IP address“12.0.3.7” from the communication log of setting error candidate whichwas output from the error detecting unit 44 (step S31), for example.This IP address “12.0.3.7” is an IP address that is set to the targetserver SVRt in FIG. 37.

The clustering unit 46 executes the step S32, and picks up thecommunication log of setting error candidates such as indicated atreference number “P31” and stores it in the memory 402 (step 92). The IPaddress of the transmission source “12.0.3.7” included in the targetcommunication log P31 matches with the IP address “12.0.3.7” selected instep S31, therefore the clustering unit 46 determines YES in step S33and executes Step S34.

The IP address of transmission destination “12.0.0.3” included in thetarget communication log P31 is not stored in the partner IP addressfield in the shaping log table Tf1 of FIG. 40, therefore it isdetermined NO in step S34 and the step S35 is executed. The clusteringunit 46 stores the IP address of transmission destination “12.0.0.3”included in the target communication log P31 as indicated at referencenumber P51, in to the partner IP address field in the shaping log tableTf1 (step S35).

Then, the clustering section 46 stores the port number of transmissiondestination “161” included in the target communication log P31, into acell of which column of the received port number of transmissiondestination intersects to row of the cell stored the IP address oftransmission destination “12.0.0.3” in step S35 in the shaping log tableTf1, as indicated by reference P51 (Step S36).

Then, the clustering unit 46 stores the port number of transmissionsource “*****” of the target communication log P31, into a cell of whichcolumn of the received port number of transmission source intersects torow of the cell stored the IP address of transmission source “12.0.0.3”in step S35 in the shaping log table Tf1, as indicated by reference P51(step S37).

Then, the clustering unit 46 executes the processes of the step S32 tothe step S37 for seven communication logs of setting error candidatefrom the communication log of setting error candidate depicted by thereference P32 until a communication log of setting error candidatedepicted by the reference P33 in FIG. 36. As a result, the clusteringsection 46 stores the port number of transmission source and the portnumber of transmission destination included in seven communication logsof setting error candidate into the received port number of transmissionsource field and the received port number of transmission destinationfield in FIG. 40 (referring to cluster log depicted by referencesP52˜P53 in FIG. 40).

And the clustering unit 46 executes the step S32 and picks up thecommunication log of setting error candidates such as indicated atreference number “P34” in FIG. 36 and stores it in the memory 402 (stepS32). The IP address of the transmission source “12.0.3.6” included inthe target communication log P34 does not match with the IP address“12.0.3.7” selected in step S31, therefore the clustering unit 46determines NO in step S33 and executes Step S38 in FIG. 39A.

The IP address of transmission source “12.0.3.6” included in the targetcommunication log P34, is not stored in address column of the partner IPaddress of the shaping log table Tf1 in FIG. 40, therefore NO isdetermined in step S38 and the process proceeds to step S39. Theclustering unit 46 stores the IP address of transmission source“12.0.3.6” that is included in the target communication log P34 into theaddress column of the partner IP address of the shaping log table Tf1 inFIG. 40, as indicated by reference P54 (step S39).

Then, the clustering unit 46 stores the port number of transmissionsource “*****” of the target communication log P34, into a cell of whichcolumn of the transmitted port number of transmission source intersectsto row of the cell stored the IP address of transmission source“12.0.3.6” in the step S39 in the shaping log table Tf1, as indicated byreference P54 (step S40).

And the clustering unit 46 stores the port number of transmissiondestination “56421” that is included in the target communication logP34, into a cell of which column of the transmitted port number oftransmission destination intersects to row of the cell stored the IPaddress of transmission source “12.0.3.6” in the step S39 in the shapinglog table Tf1, as indicated by reference P54 (step S41).

Then the clustering unit 36 returns the process of step S32 in FIG. 38,picks up the communication log of setting error candidate as depicted byreference P35 for example and stores it in the memory 402 (step S32).The IP address of the transmission source “12.0.0.3” included in thetarget communication log P35 does not match with the IP address“12.0.3.7” selected in step S31, therefore the clustering unit 46determines NO in step S33 and executes Step S38.

The IP address of transmission destination “12.0.0.3” included in thetarget communication log P35 is stored in the partner IP address fieldin the shaping log table Tf1 of FIG. 40 (referring to reference P51 inFIG. 40), therefore it is determined YES in step S38 and the step S40 isexecuted.

The clustering unit 46 stores the port number of transmission source“161” that is included in the target communication log P35, into a cellof which column of the transmitted port number of transmission sourceintersects to row of the cell stored the IP address of transmissionsource “12.0.0.3” (as referred to reference P51) in the shaping logtable Tf1, as depicted by reference P51.

The clustering unit 46 stores the port number of transmissiondestination “*****” that is included in the target communication logP35, into a cell of which column of the transmitted port number oftransmission destination intersects to row of the cell stored the IPaddress of transmission source “12.0.0.3” in the shaping log table Tf1,as depicted by reference P51 (step S41).

The clustering unit 46 executes the shaping process of the communicationlog as explained by FIG. 38 and FIG. 39 to all IP addresses included inthe communication logs of setting error candidate which were output fromthe error detecting unit 44.

Below, the shaping log table Tf1 in FIG. 40, which is created by theresult that the clustering unit 46 executed for all communication logsstored in the setting error candidate table Te11 in FIG. 36, will beexplained. In addition, reference Tf in FIG. 34 illustrates a state thatthe communication log database DB1 in FIG. 34 stores the shaping logtable Tf1.

(Clustering)

The clustering unit 46 dusters logs stored in each row of the shapinglog table Tf1 (hereinafter, described as the clustering log) on thebasis of similarity of the port number, In other words, the clusteringunit 46 summarizes the clustering logs with a high similarity. That is,the clustering unit 46 summarizes the clustering logs that include sameport number.

FIG. 41 is an example of a flow diagram illustrating the flow of theclustering process. The communication element of the clustering log asdescribed below, for example, is a port number. The communicationelement item, for example, is a port number of transmission destinationwhen sending, a port number of transmission source when sending, a portnumber of transmission destination when receiving, and a port number oftransmission source when receiving. In addition, after the descriptionof FIG. 41, an example of clustering will be explained.

Step S51: the clustering unit 46 selects the communication element itemincluding the communication elements of which a frequency of occurrenceis highest from among the communication element items included in thetable (for example, shaping log table Tf1 of FIG. 40) which stores theclustering logs. Then, the clustering unit 46 stores selectedcommunication element item in the memory element 402.

Step S52: the clustering unit 46 clusters the IP addresses which areincluded in the clustering logs that contains each communication elementaccording to each communication element included selected onecommunication element item in step S51. Then, the clustering section 46stores the IP address that were clustered in the memory 402 in the unitthat have clustering. This clustering is also called to a process whichintegrates the IP address.

Hereinafter, the clustering unit 46 repeats the processes of the stepS53˜S55 for the clustering logs including the clustered IP address (loopLP51˜LP52). Below, the IP addresses which were clustered are describedas first ˜N-th (N is an integer of 2 or more) clustered IP address,respectively.

Step S53: the clustering unit 46 selects the communication element itemincluding the communication elements of which a frequency of occurrenceis highest from among the communication element items which have notbeen selected by targeting the clustering logs including the clusteredIP address in step S52. Then, the clustering unit 46 stores selectedcommunication element item in the memory element 402.

Step S54: the clustering unit 46 clusters the IP addresses which areincluded in the clustering logs that contains each port number accordingto each port number included selected one communication element item instep S53, by targeting the clustering logs including the clustered IPaddresses in step S52. Then, the clustering unit 46 stores the IPaddress that were clustered in the memory 402 in the unit that haveclustering.

Step S55: the clustering unit 46 determines whether there is acommunication element item unselected. When there is unselectedcommunication element item (step S55/YES), the process returns to stepS53 (from loop LP52 to loop LP51). When there is no unselectedcommunication element item (step S55/NO), the process is finished,

The clustering unit 46 performs the processes of step S51˜S55 on eachtarget servers.

(First Example of Clustering)

With reference to FIG. 40 through FIG. 42, a first example of clusteringwill be described.

FIG. 42 is an example of a diagram schematically illustrating a firstexample of clustering. FIG. 42 is a diagram illustrating a relationshipbetween the port numbers and the IP addresses by a tree structure. Aroot node N1 indicates the IP address “12.0.3.7” that is set to thetarget server. Further, nodes N2˜N9 depicted by a solid frame indicatethe port numbers. Further, the node indicated by the dotted frame,indicates an IP address which is set to the partner server.

The clustering unit 46 executes the process in the step S51 of FIG. 41.The clustering unit 46 calculates frequencies of occurrence for each ofthe port number of transmission destination when sending, the portnumber of transmission source when sending, the port number oftransmission destination when receiving, and the port number oftransmission source when receiving (as four communication element item),which are included in the shaping log table Tf1 in FIG. 40. Then, theclustering unit 46 stores a highest frequency of occurrence port numberamong the port number of transmission source when sending, the portnumber of transmission destination when receiving, and the port numberof transmission source when receiving, and the frequency of occurrencein the memory 402. Further the clustering unit 46 selects onecommunication element item including the highest frequency of occurrenceport number among four communication element items and stores it in thememory 402.

The frequencies of occurrence for each of the port number oftransmission destination when sending, the port number of transmissionsource when sending, the port number of transmission destination whenreceiving, and the port number of transmission source when receivingdescribed in step S51, are following values.

In other words, the frequency of occurrence of each of the port numberis a value which divided the number of same port number for each of theport number of transmission destination when sending, the port number oftransmission source when sending, the port number of transmissiondestination when receiving, and the port number of transmission sourcewhen receiving by the total number of clustering logs stored in theshaping log table Tf1 in FIG. 40, In the example of FIG. 40, the totalnumber is 10.

In the example of FIG. 40, since the number of the transmitted portnumber of transmission source “161” is four, the frequency of occurrenceof the port number “161” in the transmitted port number of transmissionsource is 4/10.

In the example of FIG. 40, the highest frequency of occurrence portnumber in the transmitted port number of transmission source is “161”(4/10) and the highest frequency of occurrence port number in thetransmitted port number of transmission destination is “*****” (8/10).In the example of FIG. 40, the highest frequency of occurrence portnumber in the received port number of transmission source is “*****”(8/10) and the highest frequency of occurrence port number in thereceived port number of transmission destination is “161” (6/10). Inthis case, the received port number of transmission source is thecommunication element item which includes calculated highest frequencyof occurrence port number “*****” (8/10). Therefore, the clustering unit46 selects and stores the received port number of transmission sourceinto the memory 402.

The clustering unit 46 executes the process in the step S52. Here, inthe example of FIG. 40, the port numbers that is included in theselected port number of transmission source when receiving (eachcommunication element) are “*****”, “56241” and “162”. The port number“*****” that is included in the port number of transmission source whenreceiving is indicated by the node N2 in FIG. 42. The port number“56241” that is included in the port number of transmission source whenreceiving is indicated by the node N3 in FIG. 42. And the port number“162” that is included in the port number of transmission source whenreceiving is indicated by the node N4 in FIG. 42.

The clustering unit 46 stores information indicating that the child nodeof the node N1 is the nodes N2˜N4 in the memory 402,

Following eight IP addresses are the partner address included theclustering log that contains the port number “*****” in the port numberof transmission source when receiving, That is, the eight IP addressesare “12.0.0.3”, “12.0.0.6”, “12.1.2.11”, “12.1.2.12”, “12.0.0.5”,“12.0.0.9”, “12.1.2.61”, and “12.3.0.142” which are enclosed by thedashed line indicated by reference numeral G1 in FIG. 42. The clusteringunit 46 stores information indicating that the IP addresses belonging tothe node N2 is the eight IP addresses (represented by reference numberG1) in the memory 402.

In addition, the IP address included in the clustering log including theport number “56241” that is included in the port number of transmissionsource when receiving is a “12.0.3.6” enclosed by the dashed lineindicated by reference numeral G2 in FIG. 42.

Further, the IP address included in the clustering log including theport number “162” that is included in the port number of transmissionsource when receiving is a “12.1.2.14” enclosed by the dashed lineindicated by reference numeral G3 in FIG. 42.

The clustering unit 46 stores information indicating that the child node(leaf node) of the node N3 is a node indicating the reference number G2and the child node of the node N4 is a node indicating the referencenumber G3 in the memory 402.

In step S52, the clustering section 46 classifies the IP addressesincluded in the clustering log which is stored in the shaping log tableTf1 in FIG. 40 into three clusters (referring to reference numbers G1˜G3in FIG. 42). Here, the eight IP addresses that are executed the clusteris a first clustered IP address (referring to reference number G1 inFIG. 42). And the one IP address of the clustered “12.0.3.6” is a secondclustered IP address (referring to the reference number G2 in FIG. 42).Further, the one IP address of the clustered “12.1.2.14” is a thirdclustered IP address (referring to the reference number G3 in FIG. 42).

The clustering unit 46 executes the process in the step S53 for thefirst time. The clustering unit 46, in the execution of the step S53,calculates the frequent occurrences for each of port number inunselected communication element items by targeting the clustering logincluding the IP address that is clustered in step S52. And theclustering unit 46 stores a highest frequent occurrence port number andthe frequency occurrence for each of the communication element itemwhich were unselected in the memory 402. And the clustering unit 46selects one communication element item including the port number havinga calculated highest frequency occurrence from the unselectedcommunication element items in the memory 402.

The frequency of occurrence of each port number for each of unselectedcommunication element item described in step S53 is a value obtained bydividing the number of the same port number for each of the unselectedcommunication element item by the total number of clustering logscontained the IP addresses that are clustered.

In the example of FIG. 40, the unselected communication element item,which targets to the clustering log containing the IP addresses that areclustered in step S52, is a port number of communication source whensending, a port number of communication destination when sending, a portnumber of transmission destination when receiving. And, the total numberof clustering log including the IP address which are clustered (theclustering log including the first clustered IP address) is eight.Following, the frequency of occurrence of the port number, that isincluded in the clustering log including the first clustered IP address,will be explained.

In the example of FIG. 40, the port number with the highest occurrencefrequency port number among the port number of transmission source whensending is “161” (4/8) and the port number with the highest occurrencefrequency port number among the port number of transmission destinationwhen sending is “*****” (6/8), Further, in the example of FIG. 40, theport number with the highest occurrence frequency port number among theport number of transmission destination when receiving is “161” (6/8).In this case, the communication element item including the port numberwith the highest frequency of occurrence (“*****” (6/8) “161” (6/8)) arethe port number of transmission destination when sending and the portnumber of transmission destination when receiving. Thus, when there ismore than one port number with the highest appearance frequency, theclustering section 46 selects the communication element item in whichthe port numbers are not merged, that is, the communication element itemcontains a port number other than the port number “*****”, and stores itin the memory 402. In the example of the above case, the clusteringportion 46 selects the port number of transmission source whenreceiving.

The clustering unit 46 executes the process in the step S54 for thefirst time. Here, each of the port number that is included in theselected port number of transmission source when receiving by targetingthe clustering logs including the clustered IP address in step S52 forthe first time are “161”, “*****” and “9000”. The port number “161” thatis included in the port number of transmission destination whenreceiving is indicated by the node N6 in FIG. 42. The port number“*****” that is included in the port number of transmission destinationwhen receiving is indicated by the node N6 in FIG. 42, And the portnumber “9000” that is included in the port number of transmissiondestination when receiving is indicated by the node N7 in FIG. 42.

The clustering unit 46 stores information indicating that the child nodeof the node N2 is a node N5˜a node N7 in the memory 402.

In FIG. 40, following six IP addresses are the IP addresses in thecommunication log that contains the port number “161” in the port numberof transmission destination when receiving. That is, in FIG. 42, six IPaddresses are the IP addresses of “12.0.0.3”, “12.0.0.6”, “12.1.2.11”,“12.1.2.12”, “12.0.0.5”, and “12.0.0.9” which are enclosed by the dashedline indicated by reference numeral G4. Here, the six IP addresses whichwas clustered are a fourth clustered IP address.

The clustering unit 46 stores information indicating that the IPaddresses belonging to the node N5 are the six IP addresses (referringto reference number G4) in the memory 402.

Further, the IP address included in the clustering log that contains theport number “*****” in the port number of transmission destination whenreceiving is “12.12.61” which is surrounded by a dashed line indicatedby reference numeral G5 in FIG. 42. Further, the IP address included inthe clustering log that contains the port number “9000” in the portnumber of transmission destination when receiving is “12.3.0.142” whichis surrounded by a dashed line indicated by reference numeral G6 in FIG.42.

The clustering unit 46 stores information indicating that the child nodeof the node N6 is a node indicated by reference number G5 and the childnode of the node N7 is a node indicated by reference number G6 in thememory 402.

Here, since the communication element items which have been alreadyselected are the port number of transmission source when receiving andthe port number of transmission destination when sending, there are twounselected port number, that is, the port number of transmission sourcewhen sending and the port number of transmission destination whensending, Therefore, the clustering section 46 determines that there iscommunication element items unselected (step S55/NO), and returns to theprocess in step S53.

The clustering unit 46 executes the step S53 for the second time, In theexample of FIG. 40, in the step S53 for the second time, the unselectedcommunication element items are the port number of transmission sourcewhen sending and the port number of transmission destination whensending. And as for the fourth clustered IP address, the total number ofclustering log that contains these IP addresses is a six.

In the example of FIG. 40, the port number with the highest occurrencefrequency port number among the port number of transmission source whensending is “161” (4/6) and the port number with the highest occurrencefrequency port number among the port number of transmission destinationwhen sending is “*****” (4/6). In the example of FIG. 40, in this case,the communication element item including the port number with thehighest frequency of occurrence (“*****” (4/6), “161” (4/6)) are theport number of transmission source when sending and the port number oftransmission destination when sending. Thus, when there is more than oneport number with the highest appearance frequency (that is, the portnumber of transmission source when sending and the port number oftransmission destination when sending in FIG. 40), the clusteringsection 46 selects the communication element item in which the portnumbers are not merged, that is, the communication element item containsa port number other than the port number “*****”, and stores it in thememory 402. In the example of the above case, the clustering portion 46selects the port number of transmission source when sending and storesit to the memory 402.

The clustering unit 46 executes the process in the step S54 for thesecond time. Here, each of the port number that is included in theselected port number of transmission source when sending by targetingthe clustering logs (the clustering log contained fourth clustered IPaddress) including the clustered IP address in step S54 for the firsttime are “161”, and “-”. The port number “161” that is included in theport number of transmission source when sending is indicated by the nodeN8 in FIG. 42. The port number “-” that is included in the port numberof transmission source when sending is indicated by the node N9 in FIG.42.

The clustering unit 46 stores information indicating that the childnodes of the node N5 are a node N8 and a node 9 in the memory 402,

In FIG. 40, following four IP addresses are the IP addresses in theclustering log that contains the port number “161” in the port number oftransmission source when sending. That is, in FIG. 42, four IP addressesare the IP addresses of “12.0.0.3”, “12.0.0.6”, “12.1.2.11”, and“12.1.2.12” which are enclosed by the dashed line indicated by referencenumeral G7 in FIG. 42. Further, following two IP addresses are the IPaddresses in the clustering log that contains the port number “-” in theport number of transmission source when sending. That is, in FIG. 42,two IP addresses are the IP addresses of “12.0.0.5”, and “12.0.0.9”which are enclosed by the dashed line indicated by reference numeral G8in FIG. 42.

The clustering unit 46 stores information indicating that the child nodeof the node N8 is a node indicated by reference number G7 and a childnode of a node 9 is a node indicated by reference number G8 in thememory 402.

In the execution of step S53 for the aforementioned second time, theclustering unit 46 selected one port number of transmission source whensending among the port number of transmission source when sending andthe port number of transmission destination when sending. Therefore, theclustering unit 46 considers that there is no communication elementitems unselected (step S55/NO), the clustering section 46 finishes theclustering process,

In addition, the clustering unit 46 does not execute the process of stepS53 for the clustering log including single IP address which wasclustered. For example, the clustering unit 46 does not execute theprocess of step S53 for the clustering log including single IP address“12.0.3.6” (referring to reference number G2 in FIG. 42) and theclustering log including single IP address “12.1.2.14” (referring toreference number G3 in FIG. 42).

By the clustering process that has been described above, the IP addressin the shaping log table Tf1 in FIG. 40 executed the clustering into sixclusters as indicated by the reference numbers G2, G3, G5˜G8 in FIG. 42.

FIG. 43 is a diagram illustrated a state in which the IP addressesincluded in the shaping log table Tf1 in FIG. 40 are clustered in atable format, The refined result table Tn1 is a table provided with theitem number column on the left side of the partner IP address field inthe shaping log table Tf1. FIG. 43 illustrates a state that theclustering logs stored in the shaping log table Tf1 in FIG. 40 areclustered into six dusters.

For example, the line of the item number No. 1 the clustering logincluding the IP addresses “12.0.0.3”, “12.0.0.6”, “12.1.2.11”,“12.1.2.12”. enclosed by the dashed line indicated by the referencenumeral G7 in FIG. 42. For example, the line of the item number No. 2,the clustering log including the IP addresses “12.0.0.5”, “12.0.0.9”,enclosed by the dashed line indicated by reference numeral G8 in FIG.42.

As is apparent from the refined result table Tn1 in FIG. 43, theclustering unit 46 combines the clustering log including the same portnumber, For example, clustering unit 46 combines the clustering logsincluding the same port number of transmission source when sending“161”, the port number of transmission destination when sending “*****”,the port number of transmission source when receiving “*****”, and theport number of transmission destination when receiving “161” into one.

In addition, the reference number Tn in FIG. 34 represents a state thatthe communication log database DB1 in FIG. 34 stores a refined resulttable Tn1 by reference number Tn in FIG. 34.

The clustering unit 46 outputs the refined result table Tn1 in FIG. 43to the notification unit 45. The notification unit 45 displays therefined result table Tn1 in FIG. 43 to the administrator via a displaycontrol device 406 and a display unit 406 a (referring to FIG. 5).

In the setting error candidate table Te11 in FIG. 36, the number of thecommunication log of setting error candidates is twenty. The clusteringunit 46 consolidates this twenty communication logs of the setting errorcandidates into six items corresponding to the target server asindicated by the refined result table Tn1 in FIG. 43.

When the administrator confirms the setting of communication relatedinformation of one device which is set the IP address stored in thepartner IP address field corresponding to each item number, it ispossible that the administrator determines that same setting error ofcommunication related information has occurred with a high probabilityin the device which is set the other IP address stored in the partner Paddress field corresponding to the item number.

For example, in the case of the item No. 1, the IP addresses stored inthe partner IP address field corresponding to the item No. 1, are“12.0.0.3”, “12.0.0.6”, “12.1.2.11”, “12.1.2.12”. Here, because thesource of these clustered logs are the communication log that existsonly in the first block A20 a which has been already validated theoperation, it is possible to determine the following. In other words, itis possible that the administrator determines there is a possibilitythat the setting of application (also called as service) which utilizesthe port number of “161” in the device set the IP address “12.0.0.3”,for example, is forgotten.

And, it is possible that the administrator determines there is apossibility that the setting of application (also called as service)which utilizes the port number of “161” in the other three devices setthe IP address “12.0.0.6”, “12.1.2.11”, “12.1.2. 12”, is also forgottenis high.

In addition, the administrator determines that the setting of theapplication, that the application utilizes the port “161”, is an error.

As described above, since the administrator should investigate the causeof the setting error by looking up the clustered (consolidated) log, itis possible that the administrator finds the cause of setting error withan efficiently. As a result, it is possible to reduce man-hours work inan inspections of cause and adjustment of setting error.

(A Second Example of Clustering)

It is also possible to use the number of communications as informationthat can identify the communication content. For example, incommunications to use HTTP (Hyper text Transfer Protocol), the portnumber “80” is used. The communication in which the applications use theport number “80”, are usually carried out frequently and the number ofcommunications per unit time is many. Thus, it is possible to specifycommunication content that the communication, in which the number ofcommunications is large, is as communication in which use the HTTP forexample.

FIG. 44 is a diagram of an example of a table stored the clustering logcontaining a number of communications. FIG. 44 is a diagram of a tableprovided the number of communications field to the right of the portnumber of transmission source when receiving field when receiving in theshaping log table Tf1 in FIG. 40.

In addition, the IP address and the port number in the shaping log tableTf2 of FIG. 44, are different from the IP address and the port number ofthe shaping log table Tf1 of FIG. 40 in some part.

The clustering unit 46 executes the shaping process described in theflow of FIG. 38 for the communication log of setting error candidatesincluding a number of communications, and combines the communicationlogs of setting error candidate stored in dual into one clustering log.When combining, the clustering unit 46 adds the number of firstcommunication log of setting error candidate stored in the double withthe number of the second communication log of the setting errorcandidates, and adds the calculated number to the one clustering log.

In the following description, the number of communication field isprovided to left side of the port number field of transmission source inthe setting error candidate table Te11 of FIG. 36 and is stored thenumber of communication log. For example, the communication log P31 ofsetting error candidate of FIG. 36 includes 2562 number ofcommunications, and the communication log P35 of setting error candidateincludes 2562 number of communications.

The clustering unit 46 executes the shaping process described in theflow of FIG. 38 for the communication log of setting error candidatesincluding a number of communications, and creates the shaping log tableTf2 in FIG. 44,

When the clustering unit 46 combines the communication log P31 ofsetting error candidates including the number of communications with thecommunication log P35 of setting error candidates including the numberof communication, the clustering unit 46 executes the followingprocessing. Namely, the clustering unit 46 adds the number ofcommunication “2562” including the communication log P31 of the settingerror candidate with the number of communication “2562” including thecommunication log P35 of setting error candidate (added result is 5124),and stores it into the number of communication field in FIG. 44. In theexample, when the clustering unit 46 combines the communication log P31of setting error candidates with the communication log P35 of settingerror candidates, the clustering unit 46 stores the combined clusteringlog as the clustering log, as indicated by reference number P61 in FIG.44.

In the first embodiment, the IP addresses are clustered according to theport number (referring to FIG. 41), but in the second example, the IPaddresses are clustered according to the port number and the number ofcommunications.

Since the number of communication naturally are not constant, there is alittle possibility that the clustering logs with same number ofcommunication are stored in the shaping log table Tf2 in FIG. 44.Therefore, it is difficult to executing useful clustering for theadministrator even executing the clustering according to the number ofcommunication with variation values.

In order to perform a useful clustering for the administrator, thenumber of communication is divided into a predetermined number of group.For example, the number of communication is divided into three separategroups (“small”, “medium”, “many”, for example). When dividing intothree groups, for example, the number of communications less than 1000is a “small”, the number of communications more than 1000 and less than2999 is a “medium”, and the number of communication more than 3000 is a“many”.

FIG. 45 is a diagram of an example of a table illustrating a state inwhich a number of communication is grouped in FIG. 44.

As represented by the shaping log table Tf3 in FIG. 45, the clusteringsection 46 replaces the number of communications of 3000 or more timesby “many”, replaces and placed the number of communications of less than2999 and more than 1000 times by the “medium”, and replaces the numberof communications less than 1000 times by the “small”. In the exampleabove, the clustering section 46 replaces the number of communicationsin the clustering log indicated by reference number P71 by the “many”.And, the clustering unit 46 performs clustering as described in FIG. 40.

In addition, the reference Tf in FIG. 34 illustrates a state that thecommunication log database DB1 in FIG. 34 stores the shaping log tableTf3 in FIG. 45.

(A Second Example of Clustering)

A second example of the clustering will be explained with referring toFIG. 41, FIG. 45, and FIG. 46. FIG. 46 is a diagram illustrating a treestructure of relationships between the port number, the number ofcommunication, and the IP address. The root node N11 represents the IPaddress “12.0.3.7” which is set to the target server. Further, the nodesN12˜N19 illustrated in a solid frame illustrate the port number and thenumber of communications. In addition, the node illustrated by thedotted frame, illustrates the IP addresses set in the partner servers.

The clustering unit 46 executes the process in the step S51 of FIG. 41.The clustering unit 46 calculates frequencies of occurrence for each ofthe port number of transmission source when sending, the port number oftransmission destination when sending, the port number of transmissionsource when receiving, and the port number of transmission destinationwhen receiving (as four communication element item), which are includedin the shaping log table Tf3 in FIG. 45. Then, the clustering unit 46stores a highest frequency of occurrence port number among the portnumber of transmission source when sending, the port number oftransmission destination when receiving, the port number of transmissionsource when receiving, and the port number of transmission destinationwhen receiving, and the frequency of occurrence of selected highestfrequency of occurrence port number in the memory 402. Further theclustering unit 46 calculates frequencies of occurrence for each of thenumber of communication (one communication element item) included in theshaping log table Tf3 in FIG. 45. In addition, the clustering unit 46stores the number of communication having a highest frequency ofoccurrence and its frequency of occurrence in the memory 402.

Then, the clustering unit 46 selects one communication element itemincluding the communication element item with a highest frequency ofoccurrence among five communication element items, and stores it in thememory 402.

Following values are the frequencies of occurrence for each of the portnumber of transmission source when sending, the port number oftransmission destination when sending, the port number of transmissionsource when receiving, and the port number of transmission destinationwhen receiving described in step S51.

In other words, the frequency of occurrence for each of the port numberare values of which each of number of same port number in the portnumber of transmission source when sending, the port number oftransmission destination when sending, the port number of transmissionsource when receiving, and the port number of transmission destinationwhen receiving when sending, is divided by the total number ofclustering log stored in the shaping log table Tf3 in FIG. 45. In theexample of FIG. 45, the total number is nine.

In the example of FIG. 45, the frequency of occurrence of the portnumber “161” in the port number of transmission source when sending is5/9, because the number of the port number “161” in the port number oftransmission source is a five-time. In addition, the frequency ofoccurrence for each the number of communication as described in step S51is a value of which the number of same communication number is dividedby the total number of clustering log stored in the shaping log tableTf3 in FIG. 45 (in the example of FIG. 45, the total number is 9).

In the example of FIG. 45, the port number with the highest occurrencefrequency in the port number of transmission source when sending is“161” (5/9), and the port number with the highest occurrence frequencyin the port number of transmission destination when sending is “*****”(6/9). Also, in the example of FIG. 45, the port number with the highestoccurrence frequency in the port number of transmission source whenreceiving is a “*****” (8/9) and the port number with the highestfrequency of occurrence among the port number of transmissiondestination when receiving is a “161” (7/9). In addition, the number ofcommunication with the highest frequency of occurrence is a “many”(7/9).

In this case, since the communication element with the highest frequencyof occurrence is the port number “161” in the port number oftransmission source when receiving, the clustering unit 46 selects theport number of transmission source when receiving which is acommunication element item including the port number of highestfrequency of occurrence “*****” (8/9), and stores it in the memory 402,

The clustering unit 46 executes the process in the step S52. Here, inthe example of FIG. 45, the port numbers included in the selected portnumber of transmission source when receiving are “*****” and “162”. Theport number included in the selected port number of transmission sourcewhen receiving “*****” is indicated by a node N12 in FIG. 46. The portnumber included in the selected port number of transmission source whenreceiving “162” is indicated by a node N13 in FIG. 46.

The clustering unit 46 stores information indicating that the nodes N12and N13 are child nodes of the node N11 in the memory 402.

Following eight IP addresses are the partner IP addresses including theclustering logs having the port number “*****” in the port number oftransmission source when receiving. In other words, the eight IPaddresses are “12.0.0.3”, “12.0.0.5”, “12.0.0.6”, “12.0.0.9”,“12.1.2.11”, “12.1.2.12”, “12.1.2.61”, and “12.0.3.6” enclosed by thedashed line indicated by reference numeral G11 in FIG. 46. Theclustering unit 46 stores information indicating that the IP addressbelonging to the node N12 is the eight pieces of the IP address(reference number G11) in the memory 402.

Further, the IP address included in the clustering log that includes theport number “162” in the port number of transmission source whenreceiving, is “12.1.2.14” enclosed by the dashed line indicated byreference numeral G12 in FIG. 46. The clustering unit 46 storesinformation indicating that the child node of the node N13 is a nodeindicated by the reference number G12 in the memory 402.

In the step S52, the clustering section 46 executes the clustering theIP addresses which is stored in the shaping log table Tf3 in FIG. 45into two clusters (referring to reference number G11 and G12 in FIG.46). Here, the eight IP addresses which are clustered (referring toreference number G11 in FIG. 46) is a eleventh cluster assigned IPaddress. And the one IP address “12.1.2.14” which are clustered is atwelfth cluster assigned IP address (referring to reference numeral G12in FIG. 46).

The clustering unit 46 executes the process in the step S53 for thefirst time. The clustering unit 46, in the execution of the step S53,calculates the frequent occurrences for each of communication elements(the port number or the frequency of occurrence) in unselectedcommunication element items (the port number of transmission source whensending, the port number of transmission destination when sending, theport number of transmission destination when receiving and the number ofcommunication) by targeting the clustering log including the IP addressthat is clustered in step S52. And the clustering unit 46 stores ahighest frequent occurrence communication element and the frequencyoccurrence for each of the communication element item in the memory 402.

Then, the clustering unit 46 selects one of communication element itemwith a highest frequency of occurrence from among the unselectedcommunication element items.

The frequency of occurrence of each port number in unselectedcommunication element item described in step S53 are values of whicheach of number of same port number in each of the unselectedcommunication element item is divided by the total number of clusteringlog including the IP address which is clustered. In addition, thefrequency of occurrence of each communication number in unselectedcommunication element item described in step S53 are values of whichnumber of same communication number is divided by the total number ofclustering log including the IP address which is clustered.

In the example of FIG. 45, the unselected communication element item fortargeting the clustering log that contains the IP addresses that are theport number of transmission source when sending, the port number oftransmission destination when sending, the port number of transmissiondestination when receiving and the number of communication. And thetotal number of clustering log including the IP address which isclustered in step S52 (for example, the clustered log including theeleventh clustered IP address), is eight. Below, the port number orfrequency occurrence of communication included in the clustering logincluding the eleventh clustered IP address will be explained.

In the example of FIG. 45, the port number with the highest occurrencefrequency in the port number of transmission source when sending is“161” (5/8), and the port number with the highest occurrence frequencyin the port number of transmission destination when sending is “*****”(6/8). Also, in the example of FIG. 45, the port number with the highestoccurrence frequency in the port number of transmission destination whenreceiving is a “161” (7/8), And in the example of FIG. 45, the number ofcommunication with the highest frequency of occurrence among the numberof communication is a “many” (6/8),

In this case, since the communication element with the highest frequencyof occurrence is the port number “161” (7/8) in the port number oftransmission destination when receiving, the clustering unit 46 selectsthe port number of transmission destination when receiving which is acommunication element item including the port number of highestfrequency of occurrence “161”.

The clustering unit 46 executes the process in the step S54 for thefirst time. Here, each of the port number that is included in theselected port number of transmission destination when receiving selectedin the step S53 by targeting the clustering logs including the clusteredIP address are “161”, and “*****”. The port number “161” that isincluded in the port number of transmission destination when receivingis indicated by the node N14 in FIG. 46. The port number “*****” that isincluded in the port number of transmission destination when receivingis indicated by the node N15 in FIG. 46.

The clustering unit 46 stores information that the child node of thenode N12 is a node N14 and the child node of the node N15 is the nodeindicated by reference number G14 in the memory 402.

In FIG. 45, following seven IP addresses are the IP addresses in theclustering log that contains the port number “161” in the port number oftransmission destination when receiving. That is, in FIG. 42, seven IPaddresses are the IP addresses of “12.0.0.3”, “12.0.0.5”, “12.0.0.6”,“12.0.0.9”, “12.1.2.11”, “12.1.2.12” and “12.0.3.6” which are enclosedby the dashed line indicated by reference numeral G13 in FIG. 46.Further, the IP address included in the clustering log that contains theport number “*****” in the port number of transmission destination whenreceiving is “12.1.2.61” enclosed by the dashed line indicated by thereference number G14 in FIG. 46.

Here, the seven clustered IP address is a thirteenth clustered IPaddress.

The clustering unit 46 stores information that the IP address belongingto the node N14 is the seven IP addresses (referring to reference numberG13) in the memory 402.

Here, since the communication element item selected already is the portnumber of transmission source when receiving and the port number oftransmission destination when receiving, the unselected communicationelement item exist the port number of transmission source when sending,the port number of transmission destination when sending, and the numberof communication. Accordingly, the clustering unit 46 determines thatthere is a communication element item unselected (step S55/NO), andreturns to the step S53.

The clustering unit 46 executes the process in the step S53 for thesecond time. In the example of FIG. 45, the unselected communicationelement item for targeting the clustering logs that have been clusteredin the S54 for the first time is the port number of transmission sourcewhen sending, the port number of transmission destination when sending,and the number of communication. And for the thirteenth clustered IPaddress, the total number of clustering log including this IP address isseven.

In the example of FIG. 45, the port number with the highest occurrencefrequency in the port number of transmission source when sending is“161” (4/7), and the port number with the highest occurrence frequencyin the port number of transmission destination when sending is a “*****”(5/7). The communication number of times with the highest frequency ofoccurrence is a “many” (6/7).

in this case, since the communication element having the highestfrequency of occurrence is the number of communications “many” (6/7),the clustering unit 46 selects the number of communication which is acommunication element item including the port number with highestfrequency occurrence “many” (6/7), and stores it into the memory 402.

The clustering unit 46 executes the process in the step S54 for thesecond time. Here, each of the number of communication, which areselected in the step S53 for the first time by targeting the clusterlogs (including the communication log that contains the thirteenth IPaddress that are clustered) including the IP address which are clusteredin the step S54 for the first time, are a “many” and a “medium”. Thenumber of communication “many” is indicated by a node N16 and the numberof communications “medium” is indicated by a node N17 in FIG. 46.

The clustering unit 46 stores information that a child node of the node14 is the node N16 and the node N17 in the memory 402.

In FIG. 45, following six IP addresses are the IP addresses included inthe clustering logs containing the number of communications “many” inthe number of communication field. That is, the six IP addresses are“12.0.0.3”, “12.0.0.5”, “12.0.0.6”, “12.0.0.9”, “12.1.2.11”, and“12.1.2.1” which are enclosed by a chain line indicated by referencenumeral G15 in FIG. 45. Here, the six IP addresses which were clusteredis called as fourteenth clustered IP address.

The clustering unit 46 stores information that the IP address belongingto the node N16 is the six IP addresses (indicated by reference numeralG15) in the memory 402.

Further, IP address included in the clustering log, that contains thenumber of communications “medium” in the number of communication field,is “12.0.3.6” which is enclosed by the chain line indicated by referencenumeral G16 in FIG. 46.

The clustering unit 46 stores information indicating that a child nodeof the node N17 is a node indicated by a reference numeral G16 in thememory 402.

Here, since the communication element items which have been selectedalready are the port number of transmission source when receiving, theport number of transmission destination when receiving and the number ofcommunications, the unselected communication element items are the portnumber of transmission source when sending and the port number oftransmission destination when sending. Accordingly, the clustering unit46 determines that there is the unselected communication element item(step S55/NO), and returns the step S53.

The clustering unit 46 executes the process in the step S53 for thethird time. In the example of FIG. 45, the unselected communicationelement items for targeting the clustering logs that have been clusteredin the step S54 for the second time are the port number of transmissionsource when sending and the port number of transmission destination whensending. And, for the fourteenth clustered IP address, the total numberof clustering log including this IP address is six.

In the example of FIG. 45, the port number with the highest occurrencefrequency in the port number of transmission source when sending is“161” (4/6), and the port number with the highest occurrence frequencyin the port number of transmission destination when sending is a “*****”(4/6). In this case, the communication element item having the portnumber of highest frequency of occurrence (“*****” (4/6) and “161”(4/6)) are the port number of transmission source when sending and theport number of transmission destination. In this way, when there is aplurality of the port number of highest frequency of occurrence (in theexample of FIG. 45, the port number of transmission source when sendingand the port number of transmission destination), the clustering unit 46selects the communication element item including the port number whichwas not merged, that is, other port number except the port number“*****”. In the example, the clustering unit 46 selects the port numberof transmission source when sending and stores it into the memory 402.

The clustering unit 46 executes the process in the step S54 for thethird time. Here, the port number of transmission source when sending,which are selected in the step S53 for the third time by targeting thecluster logs including the IP address which are clustered in the stepS54 for the second time, is “161” and “-”. The port number oftransmission source when sending “161” is indicated by a node N18 andthe port number of transmission source when sending “-” is indicated bya node N19 in FIG. 46.

The clustering unit 46 stores information indicating that the childnodes of the node N16 are a node N18 and a node N19 in the memory 402.

In FIG. 45, following four IP addresses are the IP addresses in theclustering log that contains the port number “161” in the port number oftransmission source when sending, That is, four IP addresses are the IPaddresses of “12.0.0.3”, “12.0.0.6”, “12.1.2.11”, and “12.1.2.12” whichare enclosed by the chain line indicated by reference numeral G17 inFIG. 46. Further, following two IP addresses are the IP addresses in theclustering log that contains the port number “-” in the port number oftransmission source when sending, That is, the two IP addresses are“12.0.0.5” and “12.0.0.9” enclosed by the chain line indicated by thereference number G18 in FIG. 46.

The clustering unit 46 stores information indicating that the child nodeof the node N18 is a node indicated by reference numeral G17 and thechild of node N19 is a node indicated by reference numeral G18 in thememory 402.

In the execution of the step S53 for the third time, the clustering unit46 selected one port number of transmission source when sending amongthe port number of transmission source when sending and the port numberof transmission destination when sending. Therefore, the clustering unit46 determines there is no unselected communication element item (thestep S55/No), and finishes the clustering process.

BY the clustering process that has been described above, the IPaddresses in the shaping log table Tf3 in FIG. 45 are clustered intofive clusters as indicated by the reference numeral G12, G14, G16, G17and G18 in FIG. 46.

FIG. 47 is a diagram indicating a state in which executing a cluster ofthe IP addresses included in the shaping log table Tf3 in FIG. 45 in atable format. The refined result table Tn2 is a table which are providedwith the item field on the left side of the partner IP address field andthe number of communication field on the right side of the port numberof transmission destination when receiving field in the shaping logtable Tf3.

FIG. 47 illustrates a state which the clustering logs that are stored inthe shaping log table Tf3 in FIG. 45 are clustered into five cluster,

For example, in the line of item No. 1, the clustering log including theIP addresses “12.0.03”, “12.0.0.6”, “12.1.2.11”, “12.1.2.12”, which areenclosed by the chain line indicated by reference numeral G17 in FIG.46, is stored. Then, the line of the item No, 5, the clustering logincluding the IP address “12.0.3.6” enclosed by the chain line indicatedby reference numeral G16 in FIG. 46.

As is apparent from the refined result table Tn2 of FIG. 47, theclustering unit 46 gathers together the clustering logs including thesame port number and the number of communications. For example, theclustering unit 46 gathers together the clustering log including thesame port number of transmission source when sending “161”, same portnumber of transmission destination when sending “*****”, the same portnumber of transmission source when receiving “*****”, same port numberof transmission destination when receiving “161” and the number ofcommunication “many”, into one, as indicated in the item No. 1.

In addition, the reference numeral Tn in FIG. 34 illustrates a statethat the communication log database DB1 in FIG. 34 stores the refinedresult table Tn2.

The clustering unit 46 outputs the refined result table Tn2 in FIG. 47to the notification unit 45. The notification unit 45 displays therefined result table Tn2 in FIG. 47 to the administrator through thedisplay control device 406 and the display unit 406 a (referring to FIG.5).

FIG. 48 is an example of a diagram illustrating a state in which the IPaddresses included in the shaping log table Tf2 of FIG. 44 are executedthe clustering without referring the number of communication as ameasure of similarity, in a table format. The refined result table Tn3is a table which is provided with the item No. field on the left side ofthe partner IP address field in the shaping log table Tf3.

By comparing the refined result table Tn2 of FIG. 47 with the refinedresult table Tn3 of FIG. 48, the difference will be explained. In otherwords, the difference is that the clustering log including the IPaddress “12.0.3.6”, which is stored in the cell that the line of theitem No. 1 in the refined result table Tn3 in FIG. 48 intersects to thepartner address field, is stored in the line of the item No. 5 in FIG.47.

When the administrator looked at the refined result table Tn3 in FIG.48, the administrator checks the setting error in five devices which areset the partner IP address in the item No. 1. However, it is preferableto check the setting error of the device, which has recorded thecommunication log of many communication (that is, the device withfrequently communication), as priority, instead of evenly checking thesetting errors of five devices.

According to the refined result table Tn2 of FIG. 47, the clustering logincluding the IP address “12.0.3.6”, which is combined into one in theexample of FIG. 48, is stored in the line of the item No. 5 in FIG. 47.Therefore, the administrator should check the setting error of thedevices that are set the IP address “12.0.3.6” (which performscommunication with the number of communications “medium”) after loweringthe priority of the confirmation order which is set for the device.Accordingly, it is possible to check the setting error of the devicerecording that the communication log communication is frequently, aspriority.

[Fifth Embodiment of Administration Device]

The administration device in the fifth embodiment, execute theclustering again by referring the configuration information for the IPaddress after executing the cluster that is discussed in the fourthembodiment, in order to perform more efficient investigation of settingerror by the administrator. This configuration information is stored ina CMDB 14 (referring to FIG. 2) in the operator management server groupMC (referring to FIG. 1) which connects the administration device 4through the network and N. Below, the again clustering is referred to asappropriate re-clustering.

The clustering unit 46 classifies (also called as clustering) thecommunication log of setting error, which was classified according tothe similarity of the information indicating the relationship betweenthe transmission source and the transmission destination of thecommunication included the communication log of setting error (alsoreferred as a communication log of setting error), which was classifiedas described in the fourth embodiment.

Here, the source and destination of communication included in thecommunication history of setting error are the IP address, for example.And the information indicating the relationship between the source anddestination of the communication is a configuration information storedin the CMDB 14 (referring to FIG. 2). In other words, the communicationhistory of setting error includes the transmission source andtransmission destination of the communication, but does not includeinformation indicating the relationship between the source anddestination of the communication.

By performing this clustering, the administration device 4 collects thecommunication logs of setting error related to the devices having acommon network connection construction and the devices at the samelocation, for example.

(Configuration Management Database)

The CMDB14 depicted by FIG. 1 is a configuration management database(CMDB: Configuration Management Database) and a database that stores theconfiguration information related to the operation and management of aninformation processing system SYS.

The CDMB stores configuration item (CI) including information related tothe devices (for example, servers, switches) in the informationprocessing system SYS and information related to software of which thedevices execute, and relationship element information (also called asRelationship) indicating the relationship between the configurationitems.

It is possible that the clustering unit 46 searches second configurationitem related to a first configuration item by using the configurationitem and the relationship element information stored in the CDMB 14.

FIG. 49A and FIG. 49B illustrate the configuration items, FIG. 49Cillustrates the configuration element information, FIG. 49D is a diagramthat a virtual server identified by the identification VServer005 isexecuted on a physical server that is identified by an identifierServer001. In FIG. 49D, an arrow indicated by reference Dom0 indicatesthat the virtual server is executed on the physical server.

In a tag of the configuration item C1 <item id=“VServer005”,type=“Vserver”> in FIG. 49A, the “VServer” following to the “type”indicates that the configuration item C1 is a virtual server, and the“VServer” following to the “item id” indicates that the identifier forthis virtual server is “VServer005”.

In a tag of the configuration item C2 <item id=“Server001”,type=“Server”> in FIG. 49B, the “Server” following to the “type”indicates that the configuration item C2 is a physical server; and the“Server 001” following to the “item id” indicates that the identifierfor this physical server is “Server001”.

Below, a string sandwiched a tag <name> and a tag </name> indicates thename of the configuration item. A string sandwiched in the tag <cpu> andthe tag </cpu> indicates the operation clock number of the CPU of theconfiguration item. A string sandwiched in the tag <memory> and</memory> indicates the memory capacity of the configuration item. Astring sandwiched in the tag <ipAddress> and the tag </ipAddress>indicates the IP address set in the configuration item. A stringsandwiched in the tag <status> and the tag </status> indicates the stateof the configuration item.

In the tag of the relationship element information <relationshipid=“Rel405”, type=“Dom0”> in FIG. 49C, the “Dom0” following to the“type=” indicates that the configuration item that will be the source(virtual server) is executed by the configuration item that will be thetarget (physical server).

Below, the string that is sandwiched between the tag <sourceItem> andthe tag </sourceItem> indicates the identifier that identifies theconfiguration item that will be a source. And the string that issandwiched between the tag <targetItem> and the tag </targetItem>indicates an identifier for identifying the configuration item that willbe a target.

It is possible that the clustering unit 46, by referring theconfiguration items C1, C2 and the relationship element information,searches the configuration item C2 related to the configuration item C1.In addition, it is possible that the clustering unit 46 determines thatthe configuration item C1 relates to the configuration item C2 in arelationship indicated by FIG. 49D.

FIG. 50A illustrates the configuration items, FIG. 50B illustrates theconfiguration element information. FIG. 50C illustrates the relationshipbetween the configuration elements. FIG. 50C illustrates a diagram thata switch identified by the identification “Switch001” connects to aphysical server that is identified by an identifier “Server001” via thenetwork. In FIG. 50C, an arrow indicated by reference numeral LinkToindicates that the physical server connects to the switch via thenetwork.

In addition, the network connection between the configuration items isnot limited to the network connection to the switch and the physicalservers. For example, the network connections between the switches, andbetween the physical servers and between the virtual servers areapplied. Further, the virtual server may connect to the physical servervia the network.

In a tag of the configuration item C3 <item id=“Switcth001”,type=“Switch”> in FIG. 50A, the “Switch” following to the “type”indicates that the configuration item C3 is a switch, and the“Switch001” following to the “item id” indicates that the identifier forthis switch is “Switch001”.

Below, a string sandwiched in the tag <manufacture> and the tag</manufacture> indicates a manufacture of the configuration item. Astring which is sandwiched in the tag <model> and the tag </model>indicates the model number of the configuration item. A stringsandwiched by the tag<ipAddress> and the tag</ipAddress> indicates theIP address that is set to the configuration item.

In a tag of relationship element information R2 <relationshipid=“Rel001”, type=“LinkTo”> in FIG. 50, the “LinkTo” following to the“type=” indicates that the configuration item as the source (switch)connects to the configuration item as the target (physical server) viathe network. The construction of the physical server is indicated by theconfiguration item C2 in FIG. 49B.

It is possible that the clustering unit 46, by referring theconfiguration items C2, C3 and the relationship element information,searches the configuration item C3 related to the configuration item C2.In addition, it is possible that the clustering unit 46 determines thatthe configuration item C2 relates to the configuration item C3 in therelationship indicated by FIG. 50C.

Although not illustrated in the figures, the relationship elementinformation including the tag <relationship id=“Re1002”type=“ManagedBy”> has information that the configuration item serving asa source is managed by the configuration item serving as the target.Also, information indicating the location of the configuration item maybe added to the relationship element information.

(Examples of Network Configuration)

FIG. 51 is a diagram illustrating a network configuration of the virtualservers and the devices that are set with the source IP address and thedestination IP address described in FIG. 35 in the fourth embodiment.This network configuration is the network configuration in the firstblock A20 a in FIG. 2, for example.

The reference “Server” in the block in FIG. 51 indicates that this blockis a physical server, and the reference numeral “X1, X2, X3, X4” (X1,X2, X3, X4=0˜255) under the reference “Server” is the IP address that isset to the physical server. For example, it is indicated that, in thephysical server SVR10, the IP address “12.0.0.1” is set to this physicalserver.

The reference “VM” in the second block provided on the inside of thefirst block of the physical server in FIG. 51, indicates a virtualserver, and the reference numeral “X1, X2, X3, X4” under the reference“VM” indicates the IP address set in the virtual server. For example, itis indicated that, in a virtual server VM10, the IP address “12.0.3.7”is set to the virtual server.

The “Switch” in the block in FIG. 51, indicates that this block is aswitch, and the reference numeral “X1, X2, X3, X4” under the “switch”,indicates the IP addresses set on the switch. For example, it isindicated that the IP address “12.0.0.220” is set to the switch SW.

Solid lines between the blocks in FIG. 51 indicates schematically anetwork connection between the blocks.

The CMDB14 stores the configuration items for each of the switch, thephysical servers, and the virtual servers described in FIG. 51 andfurther stores the relationship element information between theconfiguration items.

(Grouping)

The clustering unit 46 executes the following process as a preliminarystep for performing clustering by referring to the configurationinformation for the IP address after the cluster that is described inthe fourth embodiment. In other words, the clustering unit 46 extractsthe IP addresses set to each of a plurality of the partner servers ofwhich the relationship from the target server to the partner server ismatched, and executes the grouping of the plurality of IP addresses thatwere extracted.

FIG. 52 is an example of a flow diagram illustrating the grouping of IPaddresses as mentioned above.

Step S61: the clustering unit 46 refers to the configuration item andthe relationship element information stored in the CMDB 14, extracts therelationship between the configuration items, refers to the relationshipbetween the configuration items extracted, extracts the relationshipfrom the target server to the partner server, and stores it into thememory 402.

Step S62: the clustering unit 46 extracts the IP addresses set to eachof a plurality of the partner servers, of which the relationship fromthe target server to the partner server is matched, executes thegrouping of the plurality of IP addresses that were extracted, combinesthe grouped IP address into group and stores it to the memory 402.

The clustering unit 46 executes the processes in the step S61 and thestep S62 for each of the target servers.

Next, by referring to FIG. 53 and FIG. 54, the grouping of IP addressesin FIG. 52 will be described. FIG. 53 is a schematic diagramillustrating the relationship to the partner server from the targetserver.

The ellipse illustrates schematically the configuration items (forexample, switches, physical servers, virtual servers). The IP addresses“X1, X2, X3, X4” in the ellipse indicate the IP addresses set to theconfiguration items. Straight lines between the ellipses indicate therelationship between the configuration items represented by the ellipse.Then, the reference “Dom0”, “LinkTo”, “Managed by” described in thisstraight line indicate the contents of the relationship between theconfiguration items. The “Dom0”, “LinkTo”, and “Managed by” areexplained in FIG. 49 and in FIG. 50.

In FIG. 53, the target server indicates a server that is set with the IPaddress “12.0.3.7”. In addition, the partner server indicates a serverset the partner IP address, which is stored in the partner IP addressfield in the shaping log table Tf1 of FIG. 40.

FIG. 53 illustrates the relationship between the target servers thatwere set the IP address “12.0.3.7” and the partner server of which thepartner IP address, which is stored in the partner IP address field ofthe shaping log table Tf1 of FIG. 40, among the ten relationshipsindicated by reference numerals RLS1˜RLS10.

First, the relationship RLS1 will be explained in detail. The targetserver (VM10 in FIG. 51) that is set with the IP address “12.0.3.7” hasa relationship (referring to “Dom0”) which is executed by the physicalserver (SVR10 of FIG. 51) that is set with the IP address “12.0.0.1”.And, the physical server that is set with the IP address “12.0.0.1” hasa relationship (referring to “Link To”) which connects to the switchthat is set with the IP address “12.0.0.220” via the network. The switchset with the IP address “12.0.0.220” has a relationship (referring to“Link To”) which connects to the physical server that is set the IPaddress “12.0.0.3” via the network.

The relationship RLS2˜relationship RLS4 (For more detail, therelationship between the target server that is set with the IP address“12.0.3.7” and three physical servers which are set the IP addresses“12.0.0.5”, “12.0.0.6”, “12.0.0.9”) are same relationship of the RLS1(in other words, the same relationship as RLS1).

Then, the relationship RLS5 will be explained in detail. There is arelationship (referring to “Dom0”) that the target server (VM10 in FIG.51), which is set with the IP address “12.0.3.7”, is executed by thephysical server (SVR10 in FIG. 51) that is set with the IP address“12.0.0.1”. In addition, there is a relationship (referring to “LinkTo”)that the physical server which is set with the IP address “12.0.0.1”connects to the switch (referring to FIG. 51) that is set with IPaddress “12.1.2.11” via the network.

The relationship RLS6 and the relationship RLS7 (For more detail, therelationship between the target server that is set with the IP address“12.0.3.7” and two switches (referring to FIG. 51) which are set the IPaddresses “12.1.2.12”, “12.1.2.61”) are same relationship of the RLS5(in other words, the same relationship as RLS5).

Below, since the relationship RLS8˜relationship RLS10 are not directlyrelated to the grouping which will be described below, the descriptionthereof will be omitted.

In FIG. 53, about the relationship RLS1˜the relationship RLS10, theserver, which is set the IP address within the ellipse indicated by thefar left of the drawing, is a target server (IP address “12.0.3.7”), andthe server, which is set the IP address (for example, IP address“12.0.0.3”) within the ellipse indicated by the far right of thedrawing, is a partner server.

The CDMB stores the configuration items and the relationship elementinformation which correspond to the relationship between theconfiguration items as described in FIG. 53 above. The clustering unit46 refers to the configuration items and the relationship elementinformation, follows the configuration item relating to the targetserver, and extracts the relationship to the partner server from thetarget server (step S61). Then, the clustering unit 46 stores therelationship between configuration items extracted in the memory 402(step S61).

In the example of FIG. 53, the clustering unit 46 stores informationindicating that the relationship between the configuration items is therelationship depicted by reference numerals RLS1˜RLS10 in the memory402.

Here, for example, the target server is a server that is set the IPaddress of the transmission source included in the communication log ofthe setting error candidate, which was segmented as described in thefourth embodiment. And the partner server is a server that is set the IPaddress of the transmission destination included in the communicationlog of the setting error candidate.

FIG. 54 is a schematic diagram of the grouping process of the IPaddresses which are set to each of the plurality of partner servers thatthe relationship to the partner server from the target server matches.FIG. 54 illustrates a state that the configuration items which match therelationship are combined into one in FIG. 53.

The clustering unit 46 refers to the relationship between theconfiguration items stored in the memory 402 in the step S61, andextracts the IP address which is set to each of the partner servers inwhich the relationship to the partner server from the target servermatches (step S62).

In the example of FIG. 54, the IP address which is set to each of thepartner servers in which the relationship to the partner server from thetarget server, which is set the IP address “12.0.3.7”, matches is the IPaddress enclosed in the chain line indicated by reference numerals G21,G22.

Here, IP addresses surrounded by a chain line indicated by referencenumeral G21 are four IP addresses “12.0.0.3”, “12.0.0.5”, “12.0.0.6”,“12.0.0.9”. And the IP addresses enclosed by the chain line indicated byreference numeral G22 are three IP addresses “12.1.2.11”, “12.1.2.12”,“12.1.2.61”.

The clustering unit 46 refers to the relationship between theconfiguration items stored in the memory 402 and extracts the four IPaddresses and the two IP addresses which are set to each of the partnerservers in which the relationship to the partner server from the targetserver matches.

The clustering unit 46 executes the grouping of the plurality of IPaddresses extracted, segments the grouping IP addresses into a group andstore it in the memory 402. More specifically, the clustering unit 46stores a flag indicating that the four IP addresses belong to same groupalong with the four IP addresses in the memory 402. Then, clusteringunit 46 stores a flag indicating that the three IP addresses belong tosame group along with the three IP addresses in the memory 402.

(Re-Clustering)

FIG. 55 is an example of a flow diagram illustrating the re-clustering.

Step S71: the clustering unit 46 specifies the grouped IP address fromthe IP addresses which were clustered.

Step S72: the clustering unit 46 determines whether or not the parentnode of two or more nodes belonging to the specified IP address is same.When is a same case (step S72/YES), the process proceeds to the stepS73.

Step S73: the clustering unit 46 aggregates the clustering log includingthe IP address belonging to same parent node among the clustering logsstored in the refined result table and created in the previous step ofre-clustering.

The clustering unit 46 executes the processes of the steps S72, S73 foreach group.

The clustering unit 46 executes the processes from the step S71 to thestep S73 on each target servers.

(Examples of the Re-Clustering)

By referring to FIG. 55, FIG. 56, the example of re-clustering will bedescribed. FIG. 56 schematically illustrates a first diagram of exampleof the re-clustering. FIG. 57 schematically illustrates a second diagramof example of the re-clustering. FIG. 56 is a diagram illustrating atree structure related to the port numbers and the IP addresses, as sameas FIG. 42. The node configuration in FIG. 56 is same as the nodeconfiguration in FIG. 42. Here, as already described in the firstexample of the clustering, the clustering of the IP address is alreadyfinished.

That is, as described in the fourth embodiment of the administrationdevice, the clustering unit 46 stores node information that the childnodes of the root node N1 are nodes N2˜N4, the child nodes of the nodeN2 are nodes N5˜N7, the child nodes of the node N5 are a node N8 and anode N9.

Furthermore, the clustering unit 46 stores node information that thechild node of the node N2 is a node indicated by reference numeral G2,the child node of the node N4 is a node indicated by reference numeralG3, the child node of the node N8 is a node indicated by referencenumeral G7. And the clustering unit 46 stores node information that thechild node of the node N9 is a node indicated by reference numeral G8,the child node of the node N6 is a node indicated by reference numeralG5, the child node of the node N7 is a node indicated by referencenumeral G6.

In addition, the grouping of IP addresses which is described in FIG. 54has been completed. That is, the memory 402 stores the flag indicatingthat four IP addresses “12.0.0.3”, “12.0.0.5”, “12.0.0.6”, “12.0.0.9”,which are enclosed by the chain line indicated by reference numeral G21in FIG. 54, belong to same group. Further, the memory 402 stores theflag indicating that three IP addresses “12.1.2.11”, “12.1.2.12”,“12.1.2.16”, which are enclosed by the chain line indicated by referencenumeral G22 in FIG. 54, belong to same group.

The clustering unit 46 identifies the grouped IP address described inFIG. 54 among the IP addresses which were executed the clustering in thememory 402 (step S71). In the example in FIG. 56, the IP addressesindicated by the reference numerals G21, G22 are identified. Here, fourIP addresses indicated by the reference numeral G21 is referred as afirst group and two IP addresses indicated by the reference numeral G22is referred to as a second group.

The clustering unit 46 determines whether or not the parent node of twoor more nodes belonging to the specified IP address is same, per groupedIP address (step S72). In the first group, the parent node of two nodesN8, N9 belonging to specified four IP address is the same parent nodeN5. Thus, the clustering unit 46 determines the YES in step S72 for thefirst group.

Here, the IP addresses belonging to the node N5 are six IP addressesindicated by reference numeral G21 and reference numeral G22 (referencenumeral G4).

The clustering unit 46 aggregates six IP addresses belonging to sameparent node N5. That is, the clustering unit 46 aggregates theclustering log including the six IP addresses belonging to same parentnode N5 among the clustering logs stored in the refined result table Tn1in FIG. 43 and created in the previous step of re-clustering (step S73).

On the other hand, in the second group, in the three IP addresses thathave been identified, the parent node of one node N8 that two IPaddresses “12.1.2.11”, “12.1.2.12” belongs to is the node N5, and theparent node of the node N6 that single IP address “12.1.2.61” belongs tois the node N2. That is, Parent nodes of three nodes N8, N9, N6 that IPaddresses belong to are different from each other. Accordingly, theclustering unit 46 determines the NO in step S72 for the second group,and does not perform process of the step S73.

FIG. 57 is a diagram schematically illustrating a state to aggregate sixIP addresses belonging to same parent node N5 in the nodes depicted bythe tree structure shown in FIG. 56.

In FIG. 57, the IP addressee belonging to the node N8 and the node N9illustrated in FIG. 56, are aggregated so as to belong to the node N5.

FIG. 58 is a diagram schematically illustrating a state to aggregate theclustering logs including six IP addresses which belong to same parentnode N5 in the clustering logs depicted by the refined result table Tn1of FIG. 43.

As represented by the item No. 1 of the refined result table Tn4 in FIG.58, the clustering unit 46 aggregates the clustering logs including sixIP addresses “12.0.0.3”, “12.0.0.5”, “12.0.0.6”, “12.0.0.9”,“12.1.2.11”, “12.1.2.12” to one (1 line). That is, the clustering unit46 aggregates the clustering logs stored in lines of the item No. 1 andthe item No. 2 on one line (referring to the item No. 1 in FIG. 58) inthe refined result table Tn1 in FIG. 43.

Then, the clustering unit 46 merges the port number of transmissionsource when sending, the port number of transmission destination whensending, the port number of transmission destination when receiving, andthe port number of the transmission destination when receiving. Theclustering unit 46 executes following process in this merge, when, inthe port number of transmission source when sending field, the portnumber of transmission destination when sending field, the port numberof transmission destination when receiving field, and the port number ofthe transmission destination when receiving field of the refined resulttable Tn1 in FIG. 43, different port number are stored. That is, theclustering unit 46 stores different port numbers in the line of one itemnumber and stores the “or” between the different port numbers in thefield of which different port numbers are stored.

For example, in the refined result table Tn1 in FIG. 43, “161” is storedin a cell in which the line of item No. 1 intersects to the port numberof transmission source when sending field, and “-” is stored in a cellin which the line of item No. 2 intersects to the port number oftransmission source when sending field. Therefore, the clustering unit46 stores “161” or “-” in a cell in which the line of item No. 1intersects to the port number of transmission source when sending field.

Meanwhile, when same port number are stored in each field of the portnumber of transmission source when sending field, the port number oftransmission destination when sending field, the port number oftransmission destination when receiving field, and the port number ofthe transmission destination when receiving field of the refined resulttable Tn1 in FIG. 43, the clustering unit 46, in the merging of the portnumbers, stores same port number (that is, not performed merging of theport number).

For example, in the refined result table Tn1 in FIG. 43, “161” is storedin a cell in which the line of item No. 1 intersects to the port numberof transmission destination when receiving field, and “161” is stored ina cell in which the line of item No. 2 intersects to the port number oftransmission destination when receiving field. Therefore, the clusteringunit 46 stores “161” in a cell in which the line of item No. 1intersects to the port number of transmission destination when receivingfield.

As described above, the clustering section 46 executes the re-clusteringof the communication logs of setting error candidates which were alreadyexecuted the clustering, according to the similarity of information(information indicating the relationship between the configuration itemsdescribed in FIG. 53 and FIG. 54) indicating the relationship betweencommunication source and communication destination included in thecommunication log of setting error candidate which were executed theclustering. In other words, the clustering unit 46 combines theclustering logs including the IP address that the relationship betweenthe source and the destination matches into one clustering log.

In the refined result table Tn4 of FIG. 58, the clustering logsincluding six partner IP addresses is aggregated in the line of item No.1. As described in the first example of the clustering in the fourthembodiment, it is possible that the administrator determines that thereis a possibility that set of the application, that uses port number“161”, is forgotten in the device set to “12.0.0.3”, for example.

And it is possible that the administrator determines that there is apossibility that set of the application, that uses port number “161”, isforgotten in the other devices set to “12.0.0.5”, “12.0.0.6”,“12.0.0.9”, “12.1.2.11”, “12.1.2.12”, for example.

The number of the device in this case is two more than the example whichis described in the first example of the clustering in the fourthembodiment by referring the refined result table Tn1 in FIG. 43.Therefore, it is possible that the administration device displays morenumber of devices which have a possibility occurred the setting error bysame case to the administrator. As a result, it is possible that theadministrator performs more efficient investigation of the settingerror.

The state that the communication log database DB1 in FIG. 34 stores therefined result table Tn4 is illustrated by reference numeral Tn in FIG.34.

In addition, even though determining that parent nodes of two or morenodes belonging to the specified IP address are same node (step S72/YES)in a group (hereinafter referred to as group GX), when the contents ofthe clustering for log that contains the specified IP address does notcharacterize to the communication contents, the clustering unit 46 doesnot aggregate the clustering logs (step S73).

More specifically, in the group GX, when the port number in all nodestill the root node N1 from the specified IP address is “*****” or “-”,the clustering unit 46 does not execute the processing in step S73, eventhough determining the YES in the step S72.

FIG. 59 is a diagram schematically illustrating that the aggregate ofclustering logs does not execute in one group.

In all nodes N21˜N24 in the way to the root node N1 from the IP addressindicated by reference numeral GX, the port number is a “*****” or “-”.In the port number of “*****” or “-”, it is not known what the portnumber.

For clustering logs that contains the IP address indicated by referencenumeral GX, the contents of the port number is unknown. Therefore, sinceit is not possible to identify the contents of the service, even if theclustering logs are aggregated, it is difficult to find a setting errorfrom the clustering log after aggregation. Therefore, the aggregation ofclustering logs is not performed.

In addition, there is a case which is detected two or more relationshipfrom the target server to the partner server not only one relationship.In such a case, for example, it is preferable to detect one relationshipwhich matches the other relationship by a priority of the networkconnection configuration. Therefore it is no need that the relationshipfrom the target server to the partner server is shortest, that is, theconfiguration item from the configuration item of the target server tothe configuration item of the partner server is minimum.

All examples and conditional language provided herein are intended forthe pedagogical purposes of aiding the reader in understanding theinvention and the concepts contributed by the inventor to further theart, and are not to be construed as limitations to such specificallyrecited examples and conditions, nor does the organization of suchexamples in the specification relate to a showing of the superiority andinferiority of the invention. Although one or more embodiments of thepresent invention have been described in detail, it should be understoodthat the various changes, substitutions, and alterations could be madehereto without departing from the spirit and scope of the invention.

The invention claimed is:
 1. An administration device in a system inwhich a first device group and a second device group are connected to anetwork, the administration device comprising: a storage deviceconfigured to store relating information which relates devices of thefirst device group to devices of the second device group; and a controlunit configured to acquire a first communication history of the firstdevice group and a second communication history of the second devicegroup, to convert first address information which specifies acommunication source and a communication destination of the firstcommunication history or second address information which specifies thecommunication source and the communication destination of the secondcommunication history into third address information set in the devicesof the second device group or fourth address information set in thedevices of the first device group according to the relating information,to compare the third address information with the second addressinformation or compare the first address information with the fourthaddress information according to the relating information, and to detecta setting error of the second address information set in the devices ofthe second device group based on a comparison result.
 2. Theadministration device according to claim 1, wherein the first and secondaddress information include IP (Internet protocol) addresses of thetransmission source and the transmission destination and port numbers ofthe transmission source and the transmission destination, and whereinthe relating information include each of the IP addresses set in eachdevice in the first device group and each of the IP addresses set ineach device in the second device group which has a same function of thefirst device group.
 3. The administration device according to claim 2,wherein the control unit creates a converted first communication historyhaving the third address information that each of the IP addresses inthe first communication history are converted into the IP addresses setin the second device group corresponding to the IP addresses in thefirst communication history, based on the relating information, detectsthe communication history in the converted first communication historywhich do not correspond with the IP address or the port number of thecommunication source and the communication destination in the secondcommunication history as a first setting error, and detects thecommunication history in the second communication history which do notcorrespond with the IP address or the port number of the communicationsource and communication destination in the converted firstcommunication history as a second setting error.
 4. The administrationdevice according to claim 3, wherein, the control unit, from the firstsetting error and the second setting error, detects a third settingerror that the IP address of the transmission source and the port numberof the transmission source are common, or a fourth setting error thatthe IP address of the transmission destination and the port number ofthe transmission destination are common, detects a setting error of theIP addresses of the transmission source and transmission destinationrelated to the first and second setting errors, and notifies detectedthe setting error.
 5. The administration device according to claim 4,wherein the control unit detects communication history having a fifthsetting error except the third and fourth setting errors, from thecommunication history having the first setting error, detects thesetting error of the IP address of the transmission source related tothe communication history having the fifth setting error in the devicesof the second device group, and notifies the setting error to bedetected.
 6. The administration device according to claim 2, wherein thecontrol unit creates a converted second communication history having thefourth address information that each of the IP addresses in the secondcommunication history are converted into the IP addresses set in thefirst device group corresponding to the IP addresses in the secondcommunication history, based on the relating information, detects thecommunication history in the converted second communication historywhich do not correspond with the IP address or the port number of thecommunication source and communication destination in the firstcommunication history as a first setting error, and detects thecommunication history in the first communication history which do notcorrespond with the IP address or the port number of the communicationsource and communication destination in the converted secondcommunication history as a second setting error.
 7. The administrationdevice according to claim 2, wherein, the control unit, when the IPaddresses of the transmission source and the transmission destinationincluded in two first communication history are respectively common, andfurther, the port number of the transmission source or the port numberof the transmission destination included in the two first communicationhistory are common, integrates the two first communication history intoone first communication history, stores the one first communicationhistory in the storage device, and acquires the specific informationfrom the one first communication history to be integrated, and wherein,when the IP addresses of the transmission source and the transmissiondestination included in the two second communication history arerespectively common, and further, the port number of the transmissionsource or the port number of the transmission destination included inthe two second communication history are common, the control unitintegrates the two second communication history into one secondcommunication history, stores the one second communication history inthe storage device, and acquires the specific information from the onesecond communication history to be integrated.
 8. The administrationdevice according to claim 2, wherein the control unit adds frequencyoccurrence of the first communication history of the plurality of firstdevice groups to the first communication history, and converts the IPaddresses of the transmission source and the transmission destination inthe first communication history of the plurality of first device groupsinto the IP addresses set in the devices of the second device groupcorresponding to the IP addresses of the transmission source and thetransmission destination, based on the relating information.
 9. Theadministration device according to claim 8, wherein the control unitdetects a first setting error that the communication history in thefirst communication history do not correspond with the IP address or theport number of the communication source and communication destination inthe plurality of second communication history, and detects a secondsetting error that the communication history in the second communicationhistory do not correspond with the IP address or the port number of thecommunication source and communication destination in the firstcommunication history.
 10. The administration device according to claim2, wherein the control unit detects communication history having thesetting error by referring the comparison result, and assembles thecommunication history having the setting error according to a similarityof the address information in the communication history having thesetting error.
 11. The administration device according to claim 10,wherein the control unit assembles assembled communication historyhaving the setting error according to a similarity of informationindicating a relationship of the transmission source and thetransmission destination in the assembled communication history havingthe setting error.
 12. An administration control method of anadministration device in a system in which a first device group and asecond device group are connected to a network, the administrationcontrol method comprising: acquiring a first communication history ofthe first device group and a second communication history of the seconddevice group; converting first address information which specifies acommunication source and a communication destination of the firstcommunication history or second address information which specifies thecommunication source and the communication destination of the secondcommunication history into third address information set in the devicesof the second device group or fourth address information set in thedevices of the first device group according to relating informationwhich relates devices of the first device group to devices of the seconddevice group; comparing the third address information with the secondaddress information or comparing the first address information with thefourth address information; and detecting a setting error of the secondaddress information set in the devices of the second device group basedon a comparison result.
 13. The administration control method accordingto claim 12, wherein the detecting comprises: first detecting a subsetof the first communication history that does not correspond to thesecond address information, as having the setting error, based on thecomparison result; and second detecting the setting error of the secondaddress information related to the subset of the first communicationhistory having the setting error, in the devices of the second devicegroup.
 14. The administration control method according to claim 12, themethod further comprising: detecting an error-containing communicationhistory having the setting error by referring to the comparison result;and assembling the error-containing communication history having thesetting error according to a similarity of the second addressinformation in the error-containing communication history having thesetting error.
 15. The administration control method according to claim14, wherein the method further comprising second assembling assembledcommunication history having the setting error according to a similarityof information indicating a relationship of the transmission source andthe transmission destination in the assembled communication historyhaving the setting error.
 16. A non-transitory computer-readable storagemedium storing therein a program for causing a computer to execute aprocess, the process comprising, acquiring a first communication historyof the first device group and a second communication history of thesecond device group; comparing first address information with secondaddress information or comparing third address information with fourthaddress information; and detecting a setting error of the second addressinformation set in the devices of the second device group based on acomparison result.
 17. The non-transitory computer-readable storagemedium according to claim 16, the process further comprising firstdetecting a subset of the first communication history that does notcorrespond to the second address information, as having the settingerror, based on the comparison result; and second detecting the settingerror of the second address information related to the subset of thefirst communication history having the setting error, in the devices ofthe second device group.
 18. The non-transitory computer-readablestorage medium according to claim 16, the process further comprising:detecting an error-containing communication history having the settingerror by referring to the comparison result; and assembling theerror-containing communication history having the setting erroraccording to a similarity of the second address information in theerror-containing communication history having the setting error.
 19. Thenon-transitory computer-readable storage medium according to claim 16,the process further comprising: assembling assembled communicationhistory having the setting error according to a similarity ofinformation indicating a relationship of the transmission source and thetransmission destination in the assembled communication history havingthe setting error.